Executive brief
A vulnerability in the Xen hypervisor's domain management system could allow a standard user or guest virtual machine to disrupt the host's management service (Xenstore). This can lead to a total system-wide denial of service, preventing the host from managing virtual machines or potentially causing the entire physical server to crash. This affects the availability of all services running on the impacted host.
Technical details
The vulnerability exists in the handling of the VIRQ_DOM_EXC virtual IRQ binding, which is linked to the XEN_DOMCTL_get_domain_state operation. An error path in the binding logic fails to verify if the underlying bitmap was actually initialized before attempting to tear it down. An unprivileged guest domain can intentionally trigger this error path. Successful exploitation can corrupt the state of Xenstore, leading to a host-wide Denial of Service (DoS) or, in rare cases, a hypervisor crash. The issue was introduced alongside the XEN_DOMCTL_get_domain_state feature in Xen version 4.21.
Affected products
- Xen Project Xen 4.21 and onwards
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched