Back to overview

CVE-2026-42487

HIGH
7.9
CVSS 3.1
Description
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.

Metadata

CVE ID
CVE-2026-42487
State
PUBLISHED
Assigner
XEN
Reserved
2026-04-27 14:20 UTC
Published
2026-06-18 13:46 UTC
Last updated
2026-06-18 15:07 UTC
Primary CWE
CWE-362
CWE-362 Concurrent Execution using Shared Resource with Impr…
Vendor / Product
Xen / Xen
Sources
cve.org  ·  NVD

Severity & Metrics

7.9 HIGH CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Xen Xen — consult Xen advisory XSA-491
Weakness (CWE)
CWESourceDescription
CWE-362 adp CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.9 HIGH 3.1 adp CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
References (1)
Back to overview