Quick answers
- Is CVE-2026-62426 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62426 being exploited in the wild.
- How severe is CVE-2026-62426?
- Informational severity, with a CVSS score of 0, published 28 July 2026.
- Which products and versions are affected?
- Xen Project Xen 4.0 and later.
- Is there a fix for CVE-2026-62426?
- A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62426 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-62426?
- Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Xen hypervisor utilizes system-wide locks for sysctl and platform operations to prevent parallel execution. However, these locks lack fairness in their acquisition mechanism. Furthermore, when XSM/Flask is enabled, the lock is acquired before permission checks are performed. A local attacker in a less-privileged domain (such as a Xenstore domain or a restricted control domain) can exploit this lack of fairness to repeatedly acquire the lock, effectively stalling more privileged entities and causing a Denial of Service (DoS) for the entire host. The issue is addressed in XSA-499 via patches that reorder permission checks and improve locking logic.
Affected products
- Xen Project Xen 4.0 and later
Timeline
- 2026-07-28: disclosed
- 2026-07-28: patched