Loading vulnerability…
Xen oxenstored quota-accounting leak causing denial of service
CVE-2026-23556 is a quota-accounting vulnerability in Xen's OCaml xenstore implementation, oxenstored. During domain teardown, oxenstored removes node data but fails to clear the associated usage counts. When the domain ID is reused, the replacement domain inherits stale quota accounting and can create fewer xenstore nodes before being considered over quota. Accumulation across domain lifecycles can eventually prevent new domains from operating. A malicious guest can accelerate the condition by exhausting its quota and repeatedly rebooting. The vulnerability affects Xen versions containing the XSA-419 fixes when configured to use oxenstored; the C implementation, xenstored, is unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Stale usage counts progressively reduce the effective xenstore node quota available to domains that reuse affected IDs. This can prevent other virtual machines from starting or functioning, causing host-level denial of service. XenServer deployments may experience a host crash or become unresponsive. The established impact is availability loss; code execution, privilege escalation, and information disclosure are not established for this vulnerability.
If you can’t patch tonight, do this now.
Perform a xenstore live update to mitigate the accumulated quota-accounting condition. This does not replace applying the permanent fix. Systems using the C xenstored implementation rather than oxenstored are not vulnerable.
Patch, then assume compromise.
Apply the appropriate XSA-483 fix for Xen 4.18.x, Xen 4.17.x, or XAPI oxenstored, or install the corresponding vendor security update. Debian 12 Bookworm is fixed in Xen 4.17.7-0+deb12u1, and Debian 13 Trixie in 4.20.3+127-gc42374a105-0+deb13u1. For XCP-ng 8.3 LTS, upgrade to xen-4.17.6-6.2.xcpng8.3 or later. For XenServer 8.4, install the latest updates in the selected Normal or Early Access channel. Upstream advises updating to the tip of the applicable stable branch before applying patches because they may not apply cleanly to release tarballs.
No public exploits tracked yet. Mallory keeps watching.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.