Executive brief
A vulnerability in the Xen hypervisor's guest management system could allow a less privileged user or virtual machine to stall more critical system operations. This occurs because the system uses a locking mechanism that does not ensure fair access, allowing one process to monopolize resources. If exploited, this can lead to a denial-of-service condition, potentially crashing or freezing the entire host server and all virtual machines running on it.
Technical details
Xen's domctl operations, used for guest management by control domains or Xenstore domains, utilize a system-wide lock for operations that cannot be executed in parallel. This lock implementation lacks fairness (CVE-2026-42489), allowing a less privileged entity to monopolize the lock and stall more privileged entities. Additionally, when XSM/Flask is enabled, the lock acquisition occurs before permission checks (CVE-2026-42490), further exposing the mechanism to abuse. An attacker with sufficient privileges to trigger domctl operations can cause a host-wide Denial of Service. The issue affects Xen versions 3.3 and later and is resolved by applying patches provided in XSA-492.
Affected products
- Xen Project Xen 3.3 and later
Timeline
- 2026-06-09: disclosed: Initial public release of XSA-492
- 2026-06-18: advisory: NVD publication date