Executive brief
A vulnerability exists in the Xen hypervisor, which is software used to run multiple virtual machines on a single physical server. An attacker controlling a specific type of virtual machine can cause the server's memory management system to become corrupted. This could allow the attacker to crash the entire physical host, steal sensitive information from other users, or gain unauthorized control over the server.
Technical details
A vulnerability in Xen's x86 shadow paging implementation occurs when certain error paths switch page-tables without updating the currently running vCPU reference. This creates a mismatch between loaded page-tables and mapcache metadata, leading to mapcache corruption. The issue specifically affects 64-bit PV guests running in shadow mode (often used during migration or as an L1TF workaround). An attacker with control over such a guest can exploit this to achieve privilege escalation, host-wide Denial of Service (DoS), or information disclosure. Patches are available for Xen versions 4.17 through 4.21 and the unstable branch.
Affected products
- Xen Project Xen 4.15 and onwards; versions with XSA-438 fix applied
Timeline
- 2026-06-09: advisory: XSA-494 initial public release
- 2026-06-18: disclosed: CVE-2026-42488 published to NVD