Executive brief
A vulnerability in the Xen hypervisor allows an unprivileged guest virtual machine to crash the central management service (xenstored). This service is responsible for managing configuration and communication between virtual machines. If crashed, administrators will be unable to perform management tasks on the host, such as starting, stopping, or configuring other virtual machines, leading to a denial-of-service state for host administration.
Technical details
The vulnerability is a denial-of-service (DoS) caused by an assertion failure in the C implementation of xenstored. An unprivileged guest can trigger this by issuing an XS_RESET_WATCHES command while inside a transaction. This causes an assert() to fire, terminating the xenstored process. The issue affects systems where xenstored or xenstore-stubdom is built without NDEBUG defined (which is the default for Xen release builds). Systems using the OCaml variant (oxenstored) or those specifically compiled with NDEBUG are not affected. Patches are available for Xen 4.17.x and 4.18.x/unstable.
Affected products
- Xen Project Xen 4.2 through 4.18.x
Timeline
- 2026-04-28: disclosed: Initial public release of XSA-484
- 2026-05-19: advisory: NVD publication date