Xen hypervisor vulnerabilities

CVE-2026-23558 describes a race condition that occurs during the grant table version change from v2 to v1 in HVM or PVH guests. This issue may lead to some status pages being freed while their mappings are still being inserted into the guest's page tables.

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking.

An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain privileges because IDT settings are mishandled during CPU hotplugging.

An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests.

An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled.

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.

A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to ensure page table entries remain in sync with other accounting done.

In the x86 architecture of Xen, a vulnerability allows local PV guest OS users to gain host privileges via vectors related to map_grant_ref.

The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, making it easier for guest OS users to defeat ASLR and other protection mechanisms.

Xen through 4.8.x mishandles the 'contains segment descriptors' property during GNTTABOP_transfer operations, which might allow PV guest OS users to execute arbitrary code on the host OS.

Xen versions up to 4.8.x on 64-bit platforms mishandle page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS.

An issue (known as XSA-212) was discovered in Xen, affecting versions 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory, potentially leading to sensitive information disclosure, host crash, or arbitrary code execution on the host due to broken emulation of bit test instructions.

Xen versions 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, allowing local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching.

Xen versions 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory, thereby gaining host OS privileges. The issue arises from mishandling of instruction pointer truncation during emulation.

The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.

Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.

Xen versions 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize the x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state. This allows local guest domains to obtain sensitive information from other domains.

The PV superpage functionality in Xen from versions 3.4.0 to 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impacts via a crafted page identifier (MFN).

Xen 4.6.x and earlier does not properly enforce limits on page order inputs for certain memory operations, which may lead to denial of service.

Xen versions 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, allowing local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.

Xen versions 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.

The hvm_msr_read_intercept function in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, allowing local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.

An issue was discovered in Xen through 4.9.x related to grant copying code that relied on the incorrect assumption that any grant pin would have a suitable page reference. When such a grant copy operation is performed on a dying domain, this assumption proves wrong, potentially leading to hypervisor memory corruption.

Xen through 4.8.x does not validate memory allocations during certain P2M operations, allowing guest OS users to obtain privileged host OS access, known as XSA-222.

Xen versions up to 4.8.x do not validate the port numbers of polled event channel ports, allowing guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information.

Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.

CVE-2026-42489 concerns the lack of fairness in the way system-wide locks are acquired during domctl operations, which may lead to issues with parallel execution of these operations.