Vulnerability-Lookup

SUSE-SU-2026:3409-1

Vulnerability from csaf_suse - Published: 2026-07-29 11:18 - Updated: 2026-07-29 11:18

Summary

Security update for xen

Severity

Important

Notes

Title of the patch: Security update for xen

Description of the patch: This update for xen fixes the following issues - CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528). - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling (bsc#1271530). - CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531). - CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532). - CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534). - CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535). - CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536). - CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537). - CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538). - CVE-2026-62434: PoD: Don't try to reclaim special pages (bsc#1271539). - pygrub is only supported in de-privileged mode (XSA-508) (bsc#1271947).

Patchnames: SUSE-2026-3409,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3409,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3409

CVE-2026-42493

5.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-42494

8.1 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-42495

8.1 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-62423

8.1 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-62424

8.1 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-62425

8.1 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-62426

5.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-62427

5.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-62428

8.1 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-62429

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-62430

2.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-62431

5.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-62432

8.5 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-62433

5.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-62434

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

Affected products

Recommended 18 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch	—	Vendor Fix

Threats

Impact important

References

61 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1271528	self
https://bugzilla.suse.com/1271530	self
https://bugzilla.suse.com/1271531	self
https://bugzilla.suse.com/1271532	self
https://bugzilla.suse.com/1271533	self
https://bugzilla.suse.com/1271534	self
https://bugzilla.suse.com/1271535	self
https://bugzilla.suse.com/1271536	self
https://bugzilla.suse.com/1271537	self
https://bugzilla.suse.com/1271538	self
https://bugzilla.suse.com/1271539	self
https://bugzilla.suse.com/1271947	self
https://www.suse.com/security/cve/CVE-2026-42493/	self
https://www.suse.com/security/cve/CVE-2026-42494/	self
https://www.suse.com/security/cve/CVE-2026-42495/	self
https://www.suse.com/security/cve/CVE-2026-62423/	self
https://www.suse.com/security/cve/CVE-2026-62424/	self
https://www.suse.com/security/cve/CVE-2026-62425/	self
https://www.suse.com/security/cve/CVE-2026-62426/	self
https://www.suse.com/security/cve/CVE-2026-62427/	self
https://www.suse.com/security/cve/CVE-2026-62428/	self
https://www.suse.com/security/cve/CVE-2026-62429/	self
https://www.suse.com/security/cve/CVE-2026-62430/	self
https://www.suse.com/security/cve/CVE-2026-62431/	self
https://www.suse.com/security/cve/CVE-2026-62432/	self
https://www.suse.com/security/cve/CVE-2026-62433/	self
https://www.suse.com/security/cve/CVE-2026-62434/	self
https://www.suse.com/security/cve/CVE-2026-42493	external
https://bugzilla.suse.com/1271528	external
https://www.suse.com/security/cve/CVE-2026-42494	external
https://bugzilla.suse.com/1271530	external
https://www.suse.com/security/cve/CVE-2026-42495	external
https://bugzilla.suse.com/1271530	external
https://www.suse.com/security/cve/CVE-2026-62423	external
https://bugzilla.suse.com/1271530	external
https://www.suse.com/security/cve/CVE-2026-62424	external
https://bugzilla.suse.com/1271530	external
https://www.suse.com/security/cve/CVE-2026-62425	external
https://bugzilla.suse.com/1271530	external
https://www.suse.com/security/cve/CVE-2026-62426	external
https://bugzilla.suse.com/1271531	external
https://www.suse.com/security/cve/CVE-2026-62427	external
https://bugzilla.suse.com/1271531	external
https://www.suse.com/security/cve/CVE-2026-62428	external
https://bugzilla.suse.com/1271532	external
https://www.suse.com/security/cve/CVE-2026-62429	external
https://bugzilla.suse.com/1271534	external
https://www.suse.com/security/cve/CVE-2026-62430	external
https://bugzilla.suse.com/1271535	external
https://www.suse.com/security/cve/CVE-2026-62431	external
https://bugzilla.suse.com/1271536	external
https://www.suse.com/security/cve/CVE-2026-62432	external
https://bugzilla.suse.com/1271537	external
https://www.suse.com/security/cve/CVE-2026-62433	external
https://bugzilla.suse.com/1271538	external
https://www.suse.com/security/cve/CVE-2026-62434	external
https://bugzilla.suse.com/1271539	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for xen",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for xen fixes the following issues\n\n- CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528).\n- CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling (bsc#1271530).\n- CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531).\n- CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532).\n- CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534).\n- CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535).\n- CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536).\n- CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537).\n- CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538).\n- CVE-2026-62434: PoD: Don\u0027t try to reclaim special pages (bsc#1271539).\n- pygrub is only supported in de-privileged mode (XSA-508) (bsc#1271947).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-3409,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3409,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3409",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3409-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:3409-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263409-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:3409-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048942.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271528",
        "url": "https://bugzilla.suse.com/1271528"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271530",
        "url": "https://bugzilla.suse.com/1271530"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271531",
        "url": "https://bugzilla.suse.com/1271531"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271532",
        "url": "https://bugzilla.suse.com/1271532"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271533",
        "url": "https://bugzilla.suse.com/1271533"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271534",
        "url": "https://bugzilla.suse.com/1271534"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271535",
        "url": "https://bugzilla.suse.com/1271535"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271536",
        "url": "https://bugzilla.suse.com/1271536"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271537",
        "url": "https://bugzilla.suse.com/1271537"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271538",
        "url": "https://bugzilla.suse.com/1271538"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271539",
        "url": "https://bugzilla.suse.com/1271539"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1271947",
        "url": "https://bugzilla.suse.com/1271947"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42493 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42493/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42494 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42494/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42495 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42495/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62423 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62423/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62424 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62424/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62425 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62425/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62426 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62426/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62427 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62427/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62428 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62428/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62429 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62429/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62430 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62430/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62431 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62431/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62432 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62432/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62433 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62433/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62434 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62434/"
      }
    ],
    "title": "Security update for xen",
    "tracking": {
      "current_release_date": "2026-07-29T11:18:18Z",
      "generator": {
        "date": "2026-07-29T11:18:18Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:3409-1",
      "initial_release_date": "2026-07-29T11:18:18Z",
      "revision_history": [
        {
          "date": "2026-07-29T11:18:18Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-devel-4.18.5_20-150600.3.53.3.i586",
                "product": {
                  "name": "xen-devel-4.18.5_20-150600.3.53.3.i586",
                  "product_id": "xen-devel-4.18.5_20-150600.3.53.3.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.18.5_20-150600.3.53.3.i586",
                "product": {
                  "name": "xen-libs-4.18.5_20-150600.3.53.3.i586",
                  "product_id": "xen-libs-4.18.5_20-150600.3.53.3.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.18.5_20-150600.3.53.3.i586",
                "product": {
                  "name": "xen-tools-domU-4.18.5_20-150600.3.53.3.i586",
                  "product_id": "xen-tools-domU-4.18.5_20-150600.3.53.3.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
                "product": {
                  "name": "xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
                  "product_id": "xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xen-4.18.5_20-150600.3.53.3.x86_64",
                "product": {
                  "name": "xen-4.18.5_20-150600.3.53.3.x86_64",
                  "product_id": "xen-4.18.5_20-150600.3.53.3.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-devel-4.18.5_20-150600.3.53.3.x86_64",
                "product": {
                  "name": "xen-devel-4.18.5_20-150600.3.53.3.x86_64",
                  "product_id": "xen-devel-4.18.5_20-150600.3.53.3.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-doc-html-4.18.5_20-150600.3.53.3.x86_64",
                "product": {
                  "name": "xen-doc-html-4.18.5_20-150600.3.53.3.x86_64",
                  "product_id": "xen-doc-html-4.18.5_20-150600.3.53.3.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-4.18.5_20-150600.3.53.3.x86_64",
                "product": {
                  "name": "xen-libs-4.18.5_20-150600.3.53.3.x86_64",
                  "product_id": "xen-libs-4.18.5_20-150600.3.53.3.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-libs-32bit-4.18.5_20-150600.3.53.3.x86_64",
                "product": {
                  "name": "xen-libs-32bit-4.18.5_20-150600.3.53.3.x86_64",
                  "product_id": "xen-libs-32bit-4.18.5_20-150600.3.53.3.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-4.18.5_20-150600.3.53.3.x86_64",
                "product": {
                  "name": "xen-tools-4.18.5_20-150600.3.53.3.x86_64",
                  "product_id": "xen-tools-4.18.5_20-150600.3.53.3.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
                "product": {
                  "name": "xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
                  "product_id": "xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-devel-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-devel-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-libs-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-tools-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        },
        "product_reference": "xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-devel-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-devel-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-libs-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-tools-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        },
        "product_reference": "xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-devel-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-devel-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-libs-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-libs-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-tools-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64"
        },
        "product_reference": "xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        },
        "product_reference": "xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42493",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42493"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Addressing certain issues, in particular related to operations which may\ntake excessively long and therefore would need preemption, has turned out\noverly costly.  Since alternatives (HVM/PVH: HAP, PV: shim) are commonly\navailable, the decision was to deprecate the functionality, while still\nretaining it for people to use at their own (security) risk.  Memory-wise\nsmall enough guests may still be okay to run.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42493",
          "url": "https://www.suse.com/security/cve/CVE-2026-42493"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271528 for CVE-2026-42493",
          "url": "https://bugzilla.suse.com/1271528"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-42493"
    },
    {
      "cve": "CVE-2026-42494",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42494"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42494",
          "url": "https://www.suse.com/security/cve/CVE-2026-42494"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271530 for CVE-2026-42494",
          "url": "https://bugzilla.suse.com/1271530"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42494"
    },
    {
      "cve": "CVE-2026-42495",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42495"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42495",
          "url": "https://www.suse.com/security/cve/CVE-2026-42495"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271530 for CVE-2026-42495",
          "url": "https://bugzilla.suse.com/1271530"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42495"
    },
    {
      "cve": "CVE-2026-62423",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62423"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62423",
          "url": "https://www.suse.com/security/cve/CVE-2026-62423"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271530 for CVE-2026-62423",
          "url": "https://bugzilla.suse.com/1271530"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-62423"
    },
    {
      "cve": "CVE-2026-62424",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62424"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62424",
          "url": "https://www.suse.com/security/cve/CVE-2026-62424"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271530 for CVE-2026-62424",
          "url": "https://bugzilla.suse.com/1271530"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-62424"
    },
    {
      "cve": "CVE-2026-62425",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62425"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62425",
          "url": "https://www.suse.com/security/cve/CVE-2026-62425"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271530 for CVE-2026-62425",
          "url": "https://bugzilla.suse.com/1271530"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-62425"
    },
    {
      "cve": "CVE-2026-62426",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62426"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo manage the system, sysctl and platform operations are used by the\ncontrol domain or a possible Xenstore domain.  Some of these operations\nmay not be executed in parallel, so a system-wide lock each is used.\nThe way those locks are acquired is, however, not providing any fairness.\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.\n\nThe sysctl issue is CVE-2026-62426.\n\nThe platform-op issue is CVE-2026-62427.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62426",
          "url": "https://www.suse.com/security/cve/CVE-2026-62426"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271531 for CVE-2026-62426",
          "url": "https://bugzilla.suse.com/1271531"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-62426"
    },
    {
      "cve": "CVE-2026-62427",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62427"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo manage the system, sysctl and platform operations are used by the\ncontrol domain or a possible Xenstore domain.  Some of these operations\nmay not be executed in parallel, so a system-wide lock each is used.\nThe way those locks are acquired is, however, not providing any fairness.\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.\n\nThe sysctl issue is CVE-2026-62426.\n\nThe platform-op issue is CVE-2026-62427.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62427",
          "url": "https://www.suse.com/security/cve/CVE-2026-62427"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271531 for CVE-2026-62427",
          "url": "https://bugzilla.suse.com/1271531"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-62427"
    },
    {
      "cve": "CVE-2026-62428",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62428"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When grant-copy operations are processed, the respective grant may or may\nnot already be in use by another operation (a mapping or another copy).\nFor all copy operations the referenced guest frame is looked up.  When\nanother operation is already active for the grant (the grant is \"pinned\"),\nwhat is being supplied back to actually carry out permission checks and\ncopy operation may not be consistent: The permission check may be carried\nout on a page different from the one involved in the copy.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62428",
          "url": "https://www.suse.com/security/cve/CVE-2026-62428"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271532 for CVE-2026-62428",
          "url": "https://bugzilla.suse.com/1271532"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-62428"
    },
    {
      "cve": "CVE-2026-62429",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62429"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Accessing the vNUMA configuration data of a guest is still possible when\ndomain destruction has already started.  The cleaning up of that\nconfiguration information is not synchronized with its retrieval by a\ndevice model controlling the guest.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62429",
          "url": "https://www.suse.com/security/cve/CVE-2026-62429"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271534 for CVE-2026-62429",
          "url": "https://bugzilla.suse.com/1271534"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-62429"
    },
    {
      "cve": "CVE-2026-62430",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62430"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Accesses to the CMOS memory contents are done using an indirect IO port\npair.  Therefore Xen needs to cache the guest chosen index, and one of\nthe usages of the index didn\u0027t take the necessary locking to avoid\nconcurrent changes.  As a result, a guest could change the index after\nit being checked, causing a subsequent out-of-bound read access to the\ncontents of an array.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62430",
          "url": "https://www.suse.com/security/cve/CVE-2026-62430"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271535 for CVE-2026-62430",
          "url": "https://bugzilla.suse.com/1271535"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-62430"
    },
    {
      "cve": "CVE-2026-62431",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62431"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The logic to handle periodic Viridian STIMERs performs a division with an\nunchecked user-controlled divisor value, that can be set to zero to cause a #DE\nfault.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62431",
          "url": "https://www.suse.com/security/cve/CVE-2026-62431"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271536 for CVE-2026-62431",
          "url": "https://bugzilla.suse.com/1271536"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-62431"
    },
    {
      "cve": "CVE-2026-62432",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62432"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The EVTCHNOP_expand_array hypercall checks for whether FIFO event\nchannels are enabled, but without holding the correct lock.  It can race\nwith EVTCHNOP_reset, resulting in dereferencing a NULL pointer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62432",
          "url": "https://www.suse.com/security/cve/CVE-2026-62432"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271537 for CVE-2026-62432",
          "url": "https://bugzilla.suse.com/1271537"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-62432"
    },
    {
      "cve": "CVE-2026-62433",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62433"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parts of the DM_OP handling code assumes the caller has provided the\nrequired number of buffers for the given operation without any checking\nbeing done.  As a result, certain operations might access stack\nrubble as structures are possibly uninitialized.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62433",
          "url": "https://www.suse.com/security/cve/CVE-2026-62433"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271538 for CVE-2026-62433",
          "url": "https://bugzilla.suse.com/1271538"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-62433"
    },
    {
      "cve": "CVE-2026-62434",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62434"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A guest started with Populated on Demand enabled (PoD) can attempt to\nreclaim pages which aren\u0027t regular guest RAM.  This can cause corruption\nof memory management state in Xen.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62434",
          "url": "https://www.suse.com/security/cve/CVE-2026-62434"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271539 for CVE-2026-62434",
          "url": "https://bugzilla.suse.com/1271539"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-devel-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-libs-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-domU-4.18.5_20-150600.3.53.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:xen-tools-xendomains-wait-disk-4.18.5_20-150600.3.53.3.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T11:18:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-62434"
    }
  ]
}

CVE-2026-42493 (GCVE-0-2026-42493)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 16:33

Title

x86 shadow paging is deprecated

Summary

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

XEN

References

3 references

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-495.html
http://xenbits.xen.org/xsa/advisory-495.html
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-495

Date Public

2026-07-28 12:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:33:23.792Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-495.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/28/12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42493",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:58:19.075241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:58:45.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-495"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All x86 systems with builds of Xen having SHADOW_PAGING=y are affected.\nNote that prior to Xen 4.7 this control didn\u0027t exist, and all builds of\nXen would be affected.  (Strictly speaking Xen 4.6 had a different, harder\nto use mechanism to disable shadow paging support: One could pass\n\"shadow-paging=n\" on the make command line.)"
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Addressing certain issues, in particular related to operations which may\ntake excessively long and therefore would need preemption, has turned out\noverly costly.  Since alternatives (HVM/PVH: HAP, PV: shim) are commonly\navailable, the decision was to deprecate the functionality, while still\nretaining it for people to use at their own (security) risk.  Memory-wise\nsmall enough guests may still be okay to run."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unprivileged guest may be able to cause Denial of Service (DoS)\naffecting the entire host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:31:11.950Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-495.html"
        }
      ],
      "title": "x86 shadow paging is deprecated",
      "workarounds": [
        {
          "lang": "en",
          "value": "Running HVM and PVH in Hardware Assisted Paging (HAP) mode will avoid this\nvulnerability.\n\nThere\u0027s no mitigation available for PV guests.  This is because shadow\nmode, if support is enabled in the hypervisor, could be engaged at any\ntime.  Note that without shadow mode built into Xen, guests not properly\ndealing with L1TF will simply be crashed instead."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-42493",
    "datePublished": "2026-07-28T12:31:11.950Z",
    "dateReserved": "2026-04-27T14:20:24.139Z",
    "dateUpdated": "2026-07-28T16:33:23.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42494 (GCVE-0-2026-42494)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:04

Title

buffer overruns in libfsimage iso9660 handling

Summary

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read

Assigner

XEN

References

1 reference

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-497.html

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-497

Date Public

2026-07-28 12:00

Credits

This issue was discovered by Syed Abdul Khaliq of BugQore.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:04:14.686627Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:04:48.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-497"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from at least 3.2 onwards are affected.  Older versions\nhave not been inspected."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:31:41.682Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
        }
      ],
      "title": "buffer overruns in libfsimage iso9660 handling",
      "workarounds": [
        {
          "lang": "en",
          "value": "XSA-443 added a mechanism to run pygrub de-privileged.  Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-42494",
    "datePublished": "2026-07-28T12:31:41.682Z",
    "dateReserved": "2026-04-27T14:20:24.139Z",
    "dateUpdated": "2026-07-28T15:04:48.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42495 (GCVE-0-2026-42495)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:01

Title

buffer overruns in libfsimage iso9660 handling

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

Assigner

XEN

References

1 reference

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-497.html

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-497

Date Public

2026-07-28 12:00

Credits

This issue was discovered by Syed Abdul Khaliq of BugQore.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42495",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:00:30.511503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-191",
                "description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:01:03.756Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-497"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from at least 3.2 onwards are affected.  Older versions\nhave not been inspected."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:31:41.743Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
        }
      ],
      "title": "buffer overruns in libfsimage iso9660 handling",
      "workarounds": [
        {
          "lang": "en",
          "value": "XSA-443 added a mechanism to run pygrub de-privileged.  Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-42495",
    "datePublished": "2026-07-28T12:31:41.743Z",
    "dateReserved": "2026-04-27T14:20:24.139Z",
    "dateUpdated": "2026-07-28T15:01:03.756Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62423 (GCVE-0-2026-62423)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 14:51

Title

buffer overruns in libfsimage iso9660 handling

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-130 - Improper Handling of Length Parameter Inconsistency

Assigner

XEN

References

1 reference

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-497.html

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-497

Date Public

2026-07-28 12:00

Credits

This issue was discovered by Syed Abdul Khaliq of BugQore.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62423",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T14:49:36.986097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-130",
                "description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T14:51:03.684Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-497"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from at least 3.2 onwards are affected.  Older versions\nhave not been inspected."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:31:41.801Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
        }
      ],
      "title": "buffer overruns in libfsimage iso9660 handling",
      "workarounds": [
        {
          "lang": "en",
          "value": "XSA-443 added a mechanism to run pygrub de-privileged.  Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62423",
    "datePublished": "2026-07-28T12:31:41.801Z",
    "dateReserved": "2026-07-14T10:28:12.654Z",
    "dateUpdated": "2026-07-28T14:51:03.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62424 (GCVE-0-2026-62424)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 14:53

Title

buffer overruns in libfsimage iso9660 handling

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-130 - Improper Handling of Length Parameter Inconsistency

Assigner

XEN

References

1 reference

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-497.html

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-497

Date Public

2026-07-28 12:00

Credits

This issue was discovered by Syed Abdul Khaliq of BugQore.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62424",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T14:53:03.759623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-130",
                "description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T14:53:51.529Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-497"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from at least 3.2 onwards are affected.  Older versions\nhave not been inspected."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:31:41.862Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
        }
      ],
      "title": "buffer overruns in libfsimage iso9660 handling",
      "workarounds": [
        {
          "lang": "en",
          "value": "XSA-443 added a mechanism to run pygrub de-privileged.  Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62424",
    "datePublished": "2026-07-28T12:31:41.862Z",
    "dateReserved": "2026-07-14T10:28:12.654Z",
    "dateUpdated": "2026-07-28T14:53:51.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62425 (GCVE-0-2026-62425)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:40

Title

buffer overruns in libfsimage iso9660 handling

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-20 - Improper Input Validation

Assigner

XEN

References

1 reference

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-497.html

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-497

Date Public

2026-07-28 12:00

Credits

This issue was discovered by Syed Abdul Khaliq of BugQore.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62425",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:40:12.638109Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:40:37.904Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-497"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from at least 3.2 onwards are affected.  Older versions\nhave not been inspected."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length.  This is\n   CVE-2026-42494.\n\n * The calculation of the System Use area may underflow.  This is\n   CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n   This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n   This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n   This is CVE-2026-62425."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:31:41.918Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
        }
      ],
      "title": "buffer overruns in libfsimage iso9660 handling",
      "workarounds": [
        {
          "lang": "en",
          "value": "XSA-443 added a mechanism to run pygrub de-privileged.  Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62425",
    "datePublished": "2026-07-28T12:31:41.918Z",
    "dateReserved": "2026-07-14T10:28:12.654Z",
    "dateUpdated": "2026-07-28T15:40:37.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62426 (GCVE-0-2026-62426)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:55

Title

sysctl and platform-op locks open to abuse

Summary

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-667 - Improper Locking
CWE-412 - Unrestricted Externally Accessible Lock

Assigner

XEN

References

1 reference

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-499.html

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-499

Date Public

2026-07-28 12:00

Credits

This issue was discovered by Jan Beulich of SUSE.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62426",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:55:06.523957Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-667",
                "description": "CWE-667 Improper Locking",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-412",
                "description": "CWE-412 Unrestricted Externally Accessible Lock",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:55:11.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-499"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from 4.0 onwards are vulnerable.  Earlier versions use\na different locking operation, but may also be vulnerable."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Jan Beulich of SUSE."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo manage the system, sysctl and platform operations are used by the\ncontrol domain or a possible Xenstore domain.  Some of these operations\nmay not be executed in parallel, so a system-wide lock each is used.\nThe way those locks are acquired is, however, not providing any fairness.\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.\n\nThe sysctl issue is CVE-2026-62426.\n\nThe platform-op issue is CVE-2026-62427."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A less privileged entity may stall an equally or more privileged entity,\npotentially leading to a Denial od Service (DoS) of up to the entire\nhost."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:31:57.586Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-499.html"
        }
      ],
      "title": "sysctl and platform-op locks open to abuse",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no known mitigation."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62426",
    "datePublished": "2026-07-28T12:31:57.586Z",
    "dateReserved": "2026-07-14T10:28:12.655Z",
    "dateUpdated": "2026-07-28T15:55:11.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62427 (GCVE-0-2026-62427)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:54

Title

sysctl and platform-op locks open to abuse

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-284 - Improper Access Control
CWE-305 - Authentication Bypass by Primary Weakness

Assigner

XEN

References

1 reference

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-499.html

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-499

Date Public

2026-07-28 12:00

Credits

This issue was discovered by Jan Beulich of SUSE.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62427",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:54:13.421567Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-305",
                "description": "CWE-305 Authentication Bypass by Primary Weakness",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:54:19.508Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-499"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from 4.0 onwards are vulnerable.  Earlier versions use\na different locking operation, but may also be vulnerable."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Jan Beulich of SUSE."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo manage the system, sysctl and platform operations are used by the\ncontrol domain or a possible Xenstore domain.  Some of these operations\nmay not be executed in parallel, so a system-wide lock each is used.\nThe way those locks are acquired is, however, not providing any fairness.\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.\n\nThe sysctl issue is CVE-2026-62426.\n\nThe platform-op issue is CVE-2026-62427."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A less privileged entity may stall an equally or more privileged entity,\npotentially leading to a Denial od Service (DoS) of up to the entire\nhost."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:31:57.645Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-499.html"
        }
      ],
      "title": "sysctl and platform-op locks open to abuse",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no known mitigation."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62427",
    "datePublished": "2026-07-28T12:31:57.645Z",
    "dateReserved": "2026-07-14T10:28:12.655Z",
    "dateUpdated": "2026-07-28T15:54:19.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62428 (GCVE-0-2026-62428)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33

Title

grant-table: type confusion in grant-copy

Summary

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

XEN

References

3 references

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-500.html
http://xenbits.xen.org/xsa/advisory-500.html
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-500

Date Public

2026-07-28 12:00

Credits

This issue was discovered by Roman S.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:33:28.183Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-500.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/28/16"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62428",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:10:28.542416Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-367",
                "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:10:53.004Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-500"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from 4.2 onwards are vulnerable.  Xen versions 4.1 and\nearlier are not vulnerable.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport.  Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Roman S."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "When grant-copy operations are processed, the respective grant may or may\nnot already be in use by another operation (a mapping or another copy).\nFor all copy operations the referenced guest frame is looked up.  When\nanother operation is already active for the grant (the grant is \"pinned\"),\nwhat is being supplied back to actually carry out permission checks and\ncopy operation may not be consistent: The permission check may be carried\nout on a page different from the one involved in the copy."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost.  Information leaks and Denial of Service (DoS) are possible as well."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:32:07.573Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-500.html"
        }
      ],
      "title": "grant-table: type confusion in grant-copy",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no known mitigation."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62428",
    "datePublished": "2026-07-28T12:32:07.573Z",
    "dateReserved": "2026-07-14T10:28:12.655Z",
    "dateUpdated": "2026-07-28T16:33:28.183Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62429 (GCVE-0-2026-62429)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33

Title

vNUMA domain cleanup may race other operations

Summary

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

XEN

References

3 references

URL	Tags
https://xenbits.xenproject.org/xsa/advisory-502.html
http://xenbits.xen.org/xsa/advisory-502.html
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Unknown: consult Xen advisory XSA-502

Date Public

2026-07-28 12:00

Credits

This issue was discovered by Teddy Astie of Vates.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:33:29.286Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-502.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/28/18"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T14:56:13.716116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:51:45.362Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-502"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from 4.5 onwards are vulnerable.  Xen versions 4.4 and\nearlier are not vulnerable.\n\nOnly entities controlling guests (on x86: HVM guests) can leverage the\nvulnerability.  These are device models running in either a stub domain or\nde-privileged in Dom0.\n\nOnly guests which have vNUMA enabled allow their controlling entities to\nleverage the vulnerability."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Teddy Astie of Vates."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Accessing the vNUMA configuration data of a guest is still possible when\ndomain destruction has already started.  The cleaning up of that\nconfiguration information is not synchronized with its retrieval by a\ndevice model controlling the guest."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "While Denial of Service (DoS) affecting the entire host and information\nleaks and are the prevailing effect, a device model stub domain or a\nde-privileged device model running in the control domain may also be\nable to elevate its privileges to that of the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:32:24.333Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-502.html"
        }
      ],
      "title": "vNUMA domain cleanup may race other operations",
      "workarounds": [
        {
          "lang": "en",
          "value": "On x86, running only PV or PVH guests will avoid the vulnerability.\n\nNot enabling vNUMA for HVM guests will also avoid the vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62429",
    "datePublished": "2026-07-28T12:32:24.333Z",
    "dateReserved": "2026-07-14T10:28:12.655Z",
    "dateUpdated": "2026-07-28T16:33:29.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:3409-1

CVE-2026-42493 (GCVE-0-2026-42493)

CVE-2026-42494 (GCVE-0-2026-42494)

CVE-2026-42495 (GCVE-0-2026-42495)

CVE-2026-62423 (GCVE-0-2026-62423)

CVE-2026-62424 (GCVE-0-2026-62424)

CVE-2026-62425 (GCVE-0-2026-62425)

CVE-2026-62426 (GCVE-0-2026-62426)

CVE-2026-62427 (GCVE-0-2026-62427)

CVE-2026-62428 (GCVE-0-2026-62428)

CVE-2026-62429 (GCVE-0-2026-62429)

Tags

Sightings

Nomenclature