Patches have been published that fix the Xen hypervisor 19 vulnerabilities, 12 of which do not exclude the possibility of exploitation to violate the isolation of the guest system and execute code on the side host environment. Other problems can cause a denial of service or lead to a memory leak. The most serious problems:
- XSA-508 (CVE not assigned) – guests using the pygrub loader can gain privileges that are sufficient in most situations to manage the host environment.
- CVE-2026-62429 – a race condition in the vNUMA cleanup code can lead to information leakage and privileges to access the host environment.
- CVE-2026-42494, CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425 – buffer overflows in the libfsimage library that occur during processing specially designed images in ISO9660 format. Guest systems that use the pygrub loader can potentially exploit code execution vulnerabilities on the host side.
- CVE-2026-62434 – guest systems that launched using the PoD (Populated on Demand) mechanism can initiate an operation to return memory pages (reclaim) that are not related to the memory of the guest system. The issue can be exploited for memory corruption in Xen.
- CVE-2026-62433 – lack of validation of requested buffers in the DM_OP hypercall implementation allows guests in HVM mode to access data on the stack related to the operation of other guests.
/Reports, release notes, official announcements.