7.5

CVE-2026-42492

vIRQ event channel binding may break Xenstore

Xenstore, to have an up-to-date picture of the entire system, wants to
know of domains appearing and disappearing.  To make this more robust, a
new XEN_DOMCTL_get_domain_state was introduced.  The management of the
bitmap underlying that operation is tied into the binding of the
VIRQ_DOM_EXC virtual IRQ.  Unfortunately an error path there would tear
down the bitmap even in cases when it wasn't set up.  Unprivileged domains
can trigger that error path.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerXen
≫
Produkt Xen
Default Statusunknown
Version consult Xen advisory XSA-496
Status unknown
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.386
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-459 Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

https://xenbits.xenproject.org/xsa/advisory-496.html
http://xenbits.xen.org/xsa/advisory-496.html
http://www.openwall.com/lists/oss-security/2026/07/28/13