Executive brief
A vulnerability in the Xen virtualization platform could allow a compromised or restricted guest management component to gain unauthorized control over the entire physical host. The issue occurs when the system fails to properly synchronize the cleanup of memory configuration data (vNUMA) while a virtual machine is being shut down. An attacker who has already gained control of a guest's device model could exploit this race condition to crash the host, leak sensitive information, or escalate their privileges to take over the entire server.
Technical details
A race condition exists in Xen versions 4.5 and later where vNUMA configuration data remains accessible after domain destruction has commenced. The cleanup process for this configuration information is not properly synchronized with its retrieval by the device model controlling the guest. An attacker controlling a device model (running in a stub domain or de-privileged in Dom0) can exploit this lack of synchronization. Successful exploitation can result in a host-wide Denial of Service (DoS), information disclosure, or privilege escalation from a de-privileged device model to host-level privileges. The vulnerability specifically affects x86 HVM guests with vNUMA enabled. Patches are available for stable branches including 4.18.x, 4.21.x, and the unstable branch.
Affected products
- Xen Project Xen 4.5 through 4.21.x
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched