Xen - vulnerabilities (CVEs)

540 CVEs in 8 products, 8 in the last 30 days, newest from 2026-10-13.

Products

Xen - 484 CVEs
Xapi - 6 CVEs
Windows Pv Drivers - 3 CVEs
Oxenstored - 1 CVEs
Qemu - 1 CVEs
Varstored - 1 CVEs
Xen-unstable - 1 CVEs
Xen Flask Module - 1 CVEs

Newest CVEs of Xen

CVE-2026-102700 - CVSS 4.7 (medium), 2026-10-13: With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the…
CVE-2026-102699 - CVSS 7.5 (high), 2026-10-13: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321)…
CVE-2026-102702 - CVSS 7.5 (high), 2026-10-13: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321)…
CVE-2026-79611 - CVSS 5.5 (medium), 2026-10-13: For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is…
CVE-2026-79610 - CVSS 8.8 (high), 2026-10-13: XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect…
CVE-2026-79609 - CVSS 8.8 (high), 2026-10-13: XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table…
CVE-2026-79608 - CVSS 9.8 (critical), 2026-10-13: The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an…
CVE-2026-79607 - CVSS 5.5 (medium), 2026-10-13: During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an…
CVE-2026-79603 - CVSS 4.3 (medium), 2026-09-08: x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is…
CVE-2026-79602 - CVSS 8.8 (high), 2026-09-08: A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
CVE-2026-62437 - CVSS 6.5 (medium), 2026-09-08: When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated…
CVE-2026-62434 - CVSS 5.3 (medium), 2026-07-28: A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory…
CVE-2026-62433 - CVSS 7.3 (high), 2026-07-28: Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a…
CVE-2026-62432 - CVSS 7.3 (high), 2026-07-28: The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset,…
CVE-2026-62431 - CVSS 7.5 (high), 2026-07-28: The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.
CVE-2026-62430 - CVSS 7.5 (high), 2026-07-28: Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of…
CVE-2026-62429 - CVSS 6.5 (medium), 2026-07-28: Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration…
CVE-2026-62436 - CVSS 6.5 (medium), 2026-07-28: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of…
CVE-2026-62435 - CVSS 6.5 (medium), 2026-07-28: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of…
CVE-2026-62428 - CVSS 7.8 (high), 2026-07-28: When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy…
CVE-2026-62427 - CVSS 8.8 (high), 2026-07-28: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl…
CVE-2026-62426 - CVSS 8.8 (high), 2026-07-28: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl…
CVE-2026-42494 - CVSS 6.1 (medium), 2026-07-28: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge…
CVE-2026-62424 - CVSS 5.5 (medium), 2026-07-28: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge…
CVE-2026-62423 - CVSS 5.5 (medium), 2026-07-28: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge…
CVE-2026-42495 - CVSS 5.5 (medium), 2026-07-28: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge…
CVE-2026-62425 - CVSS 5.5 (medium), 2026-07-28: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge…
CVE-2026-42492 - CVSS 7.5 (high), 2026-07-28: Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new…
CVE-2026-42493 - CVSS 7.5 (high), 2026-07-28: Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly…
CVE-2026-42486 - CVSS 9.4 (critical), 2026-07-09: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different…