Executive brief
A vulnerability exists in the Xen virtualization platform, which is used to run multiple virtual machines on a single physical server. A malicious user operating a guest virtual machine could exploit a flaw in how the system handles hardware clock emulation to read memory that should be restricted. While this allows access to internal system data, it does not directly allow the attacker to view data belonging to other customers' virtual machines.
Technical details
A race condition exists in Xen's x86 vRTC emulation when accessing CMOS memory via indirect IO port pairs. The hypervisor caches a guest-chosen index but fails to implement necessary locking during certain operations. This allows a guest to modify the index after it has been validated but before it is used, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw that leads to an out-of-bounds read of Xen's internal array contents. The impact is limited to information disclosure of hypervisor data; it does not permit cross-guest data access. The vulnerability affects HVM guests; PV and PVH guests are not impacted.
Affected products
- Xen Project Xen 3.2 through 4.19.x
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched