Executive brief
A flaw in the Xen Project's OCaml-based storage service (oxenstored) can lead to a denial-of-service condition for virtual machines. When a virtual machine is shut down, the system fails to properly reset its resource usage counters. Over time, this causes new virtual machines to be incorrectly flagged as exceeding their resource limits, eventually preventing them from operating or starting at all.
Technical details
A resource leak exists in oxenstored (the OCaml implementation of xenstored) where node usage counts are not cleaned up during domain teardown. When a domain ID is eventually reused, the new domain inherits the leaked usage counts, causing it to hit its node quota prematurely. A malicious or buggy guest can accelerate this exhaustion by hitting its quota and rebooting repeatedly. This issue affects systems using oxenstored that have applied XSA-419 fixes; the C implementation of xenstored is not affected. Patches are available for Xen 4.17.x, 4.18.x, and unstable branches.
Affected products
- Xen Project oxenstored All versions containing XSA-419 fixes; Xen 4.17.x, 4.18.x
Timeline
- 2026-04-28: disclosed: Initial public release of XSA-483
- 2026-07-09: advisory: NVD publication date