Loading story…
Xen disclosed XSA-499 v2 for two vulnerabilities, CVE-2026-62426 and CVE-2026-62427, affecting sysctl and platform operations that rely on system-wide locks for privileged management tasks. The flaws stem from unfair lock acquisition, allowing a less privileged entity to repeatedly obtain locks needed by the control domain or a Xenstore domain and block other operations that cannot safely run in parallel.
In deployments using XSM/Flask, Xen said some lock acquisitions can occur before permission checks, worsening the impact and enabling denial-of-service conditions that may extend to the entire host. Xen reported that all versions from 4.0 onward are confirmed vulnerable, earlier releases may also be affected, and there is no known mitigation beyond applying the vendor patches; environments using Flask also need a default policy adjustment, with corresponding updates required for custom policies.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Xen disclosed XSA-499 version 2 covering two vulnerabilities, CVE-2026-62426 and CVE-2026-62427, involving unfair acquisition of sysctl and platform-op locks. The advisory says a less privileged entity could abuse these conditions to stall equally or more privileged entities, potentially causing denial of service up to the entire host, and recommends applying patches plus a default Flask policy adjustment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Xen published **XSA-484** for `CVE-2026-23557`, a denial-of-service flaw in **xenstored** that lets an unprivileged guest crash the service by issuing the `XS_RESET_WATCHES` command inside a transaction. A successful trigger stops further Xenstore operations and can block domain administration on the host. The bug affects Xen from version 4.2 onward when using the C implementation of xenstored or `xenstore-stubdom` built without `NDEBUG`; **oxenstored** and builds compiled with `NDEBUG` are not affected. Xen said there is **no known mitigation** and advised applying patches released for **xen-unstable**, **Xen 4.18.x**, and **Xen 4.17.x**. In a separate advisory, **XSA-483** tracks `CVE-2026-23556`, a flaw in **oxenstored** where quota-related usage counts persist after a domain is destroyed. Because those counts survive domain ID reuse, newly created domains can be misclassified as over quota and gradually lose the ability to create Xenstore nodes, potentially degrading host operation until new domains cannot function. Xen said a buggy or malicious guest could speed up the impact by exhausting quota and rebooting repeatedly. The issue affects Xen deployments using **oxenstored** with the **XSA-419** fixes, while systems using the C implementation **xenstored** are not affected; Xen recommended a xenstore live update as mitigation and released patches for **Xen 4.18.x**, **Xen 4.17.x**, and **XAPI oxenstored**. Both vulnerabilities were reported by **Andrii Sultanov of Vates**.
Jun 29, 2026
Xen has disclosed two Linux guest kernel vulnerabilities affecting virtualized environments, warning that both issues require patching and have no known mitigations. **CVE-2026-31786** (`XSA-485`) affects Linux kernels **4.13 and later** in Xen domains through unsafe handling of the binary build ID exposed at `/sys/hypervisor/properties/buildid`. The bug uses `sprintf()` on a non-null-terminated binary value, which can trigger an out-of-bounds read and, in rare cases, a write past the 4 KB sysfs buffer, potentially leading to **information disclosure, denial of service, or privilege escalation** inside Linux Xen guests. A second advisory, **CVE-2026-31787** (`XSA-487`), describes a **double-free** flaw in the Linux **Xen `privcmd` driver** that allows a **root user in a Linux guest** to bypass kernel lockdown protections tied to secure boot. Xen said the issue affects Linux **PVH or HVM domains** on **x86 and Arm** from kernel **3.8 onward**, while PV domains and non-Linux guests are not affected. The vulnerabilities were reported by **Frediano Ziglio of XenServer** and **Atharva Vartak (@0xAth4rv)**, respectively, and Xen urged operators to apply the supplied Linux patches.
Jun 29, 2026
Xen disclosed **XSA-482** for **CVE-2026-31788**, a flaw in the Linux kernel's `privcmd` driver that can let an administrator inside an unprivileged Xen guest bypass kernel lockdown protections enforced under secure boot. The bug can be abused to perform actions on the guest kernel that should be blocked in secure mode, including modifying page tables in a way that could allow user mode to alter kernel memory. The issue affects Xen **PV, PVH, and HVM** guests running Linux with secure boot enabled. Xen said BSD-based systems are believed unaffected because they do not support secure boot in this context. The vulnerability was discovered by **Teddy Astie of Vates**, no mitigation is currently known, and remediation requires applying the published Linux patch set; the latest advisory revision notes that the flaw has now been assigned **`CVE-2026-31788`**.
Jun 29, 2026