Executive brief
Xen is a hypervisor platform that runs multiple virtual machines (guests) on a single physical server. When a virtual machine with assigned PCI devices is shut down, the hypervisor fails to properly clean up all memory structures associated with device interrupts, allowing a malicious guest to exhaust the hypervisor's memory and crash the entire system. This affects all organizations running Xen-based cloud infrastructure or virtualized servers.
Technical details
This vulnerability is a resource leak (CWE-400) in Xen's PCI device passthrough teardown logic. When an HVM guest with assigned PCI devices is terminated, IRQ tracking structures are cleaned up early in the shutdown process. However, the guest's device model can re-establish these tracking structures by binding IRQs again before final cleanup occurs, leaving at least one tracking structure unreleased. An attacker with control of an HVM guest can repeatedly trigger this condition to leak hypervisor memory, eventually causing denial of service of the host and all co-resident guests. The attack requires only that the guest have at least one PCI device assigned. A patch is available and applying xsa509.patch resolves the issue.
Affected products
- Xen Xen 3.2 and later
Timeline
- 2026-09-08: disclosed
- other: XSA-509 public release