Executive brief
A vulnerability in the Xen hypervisor allows a malicious virtual machine to crash the entire physical server. This occurs when the system incorrectly handles internal event communication requests, leading to a system-wide denial of service. While primarily a stability risk, it could disrupt all operations and other virtual machines running on the same hardware.
Technical details
A race condition exists in the Xen hypervisor between the EVTCHNOP_expand_array and EVTCHNOP_reset hypercalls. The expand_array operation checks if FIFO event channels are enabled without holding the necessary lock, allowing a concurrent reset operation to clear state. This results in a NULL pointer dereference when the expand operation proceeds. For HVM and ARM guests, this leads to a host crash (DoS). For x86 PV guests, while a crash is the most likely outcome, the Xen Project notes that memory corruption or privilege escalation cannot be entirely ruled out. The issue affects Xen versions 4.5 and later.
Affected products
- Xen Project Xen 4.5 and later
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched