Executive brief
A vulnerability exists in the Xen hypervisor, which is software used to run multiple virtual machines on a single physical server. A malicious or compromised virtual machine could trigger a crash of the entire physical host, leading to a total service outage for all other virtual machines on that server. In some cases, this could also lead to unauthorized access to data or increased privileges on the system.
Technical details
A race condition (CWE-362) exists in the Xen hypervisor's handling of I/O port accesses for x86 HVM guests. I/O port translations are managed via linked lists that can be modified by the device model using XEN_DOMCTL_ioport_mapping. The hypervisor failed to properly synchronize list traversal with these updates. An attacker controlling a device model (such as one running in a stub domain or a de-privileged Dom0) can exploit this lack of synchronization to cause a hypervisor crash (DoS), or potentially achieve information disclosure or privilege escalation. The vulnerability affects x86 systems only; ARM systems and PV/PVH guests are not impacted. Patches are available for supported Xen versions.
Affected products
- Xen Project Xen 3.2 and later (x86 only)
Timeline
- 2026-06-09: disclosed: Initial public release of XSA-491
- 2026-06-18: advisory: NVD publication date