GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-42492 (GCVE-0-2026-42492)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 16:33
VLAI
Title
vIRQ event channel binding may break Xenstore
Summary
Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_state was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear down the bitmap even in cases when it wasn't set up. Unprivileged domains can trigger that error path.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:56 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Xen Xen Unknown: consult Xen advisory XSA-496
guessed Create a notification for this product.
Date Public
2026-07-28 12:00
Credits
This issue was discovered by Grygorii Strashko of EPAM.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:33:22.683Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-496.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/28/13"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:56:49.876014Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-459",
                "description": "CWE-459 Incomplete Cleanup",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:56:54.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-496"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen 4.21 and onwards are vulnerable.  Xen 4.20 and older are not\nvulnerable."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Grygorii Strashko of EPAM."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xenstore, to have an up-to-date picture of the entire system, wants to\nknow of domains appearing and disappearing.  To make this more robust, a\nnew XEN_DOMCTL_get_domain_state was introduced.  The management of the\nbitmap underlying that operation is tied into the binding of the\nVIRQ_DOM_EXC virtual IRQ.  Unfortunately an error path there would tear\ndown the bitmap even in cases when it wasn\u0027t set up.  Unprivileged domains\ncan trigger that error path."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unprivileged domain can affect the operation of Xenstore, potentially\nleading to a Denial of Service (DoS) affecting the entire host.  A\nhypervisor crash with similar host wide effect also is possible, albeit\nunlikely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:31:28.304Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-496.html"
        }
      ],
      "title": "vIRQ event channel binding may break Xenstore",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no known mitigation."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-42492",
    "datePublished": "2026-07-28T12:31:28.304Z",
    "dateReserved": "2026-04-27T14:20:24.139Z",
    "dateUpdated": "2026-07-28T16:33:22.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42492",
      "date": "2026-09-13",
      "epss": "0.00459",
      "percentile": "0.38583"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42492\",\"sourceIdentifier\":\"security@xen.org\",\"published\":\"2026-07-28T13:18:32.123\",\"lastModified\":\"2026-07-28T17:16:38.303\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Xenstore, to have an up-to-date picture of the entire system, wants to\\nknow of domains appearing and disappearing.  To make this more robust, a\\nnew XEN_DOMCTL_get_domain_state was introduced.  The management of the\\nbitmap underlying that operation is tied into the binding of the\\nVIRQ_DOM_EXC virtual IRQ.  Unfortunately an error path there would tear\\ndown the bitmap even in cases when it wasn\u0027t set up.  Unprivileged domains\\ncan trigger that error path.\"}],\"affected\":[{\"source\":\"security@xen.org\",\"affectedData\":[{\"vendor\":\"Xen\",\"product\":\"Xen\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"consult Xen advisory XSA-496\",\"status\":\"unknown\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-28T15:56:49.876014Z\",\"id\":\"CVE-2026-42492\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-459\"}]}],\"references\":[{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-496.html\",\"source\":\"security@xen.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/07/28/13\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://xenbits.xen.org/xsa/advisory-496.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-07-28T18:10:46+00:00",
      "cve": "CVE-2026-42492",
      "id": "CVE-2026-42492",
      "initial_release_date": "2026-07-28T12:31:28.304000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "xen: Xen: Denial of Service in Xenstore via vIRQ event channel binding",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42492.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://xenbits.xen.org/xsa/advisory-496.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/07/28/13\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-07-28T16:33:22.683Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42492\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-28T15:56:49.876014Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-459\", \"description\": \"CWE-459 Incomplete Cleanup\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-28T15:45:44.675Z\"}}], \"cna\": {\"title\": \"vIRQ event channel binding may break Xenstore\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Grygorii Strashko of EPAM.\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An unprivileged domain can affect the operation of Xenstore, potentially\\nleading to a Denial of Service (DoS) affecting the entire host.  A\\nhypervisor crash with similar host wide effect also is possible, albeit\\nunlikely.\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-496\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2026-07-28T12:00:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-496.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"There is no known mitigation.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Xenstore, to have an up-to-date picture of the entire system, wants to\\nknow of domains appearing and disappearing.  To make this more robust, a\\nnew XEN_DOMCTL_get_domain_state was introduced.  The management of the\\nbitmap underlying that operation is tied into the binding of the\\nVIRQ_DOM_EXC virtual IRQ.  Unfortunately an error path there would tear\\ndown the bitmap even in cases when it wasn\u0027t set up.  Unprivileged domains\\ncan trigger that error path.\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Xen 4.21 and onwards are vulnerable.  Xen 4.20 and older are not\\nvulnerable.\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2026-07-28T12:31:28.304Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42492\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-28T16:33:22.683Z\", \"dateReserved\": \"2026-04-27T14:20:24.139Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2026-07-28T12:31:28.304Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.