Executive brief
Xen is a virtualization platform that runs multiple isolated operating systems on a single physical host. A flaw in how Xen handles PCI device passthrough to virtual machines allows an unprivileged guest to crash the entire host. An attacker with control over a guest virtual machine could exploit this to cause a complete denial of service to all running guests and the host itself.
Technical details
This vulnerability is a logic error in x86 HVM emulation return code handling within Xen. When a PCI device with at least one BAR (Base Address Register) in IO port space is passed through to an HVM guest, the guest can trigger a BUG() exception in the hypervisor via improper emulation return code processing. The attack is triggered from unprivileged guest context and requires the guest to have a PCI device with IO BARs assigned. Exploitation results in a host-level denial of service affecting all guests. A patch is available via XSA-510; Xen versions 4.6 and later on x86 systems are vulnerable (Arm systems are unaffected).
Affected products
- Xen Xen 4.6 and later
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patch xsa510.patch available