CVE-2026-62436 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Gran… |
CVE-2026-62435 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Gran… |
CVE-2026-62434 | Medium | 5.3 | 2026-07-28 | A guest started with Populated on Demand enabled (PoD) can attempt to
reclaim pages which aren't regular guest RAM. This can cause corruption
of memory manage… |
CVE-2026-62433 | High | 7.3 | 2026-07-28 | Parts of the DM_OP handling code assumes the caller has provided the
required number of buffers for the given operation without any checking
being done. As a… |
CVE-2026-62432 | High | 7.3 | 2026-07-28 | The EVTCHNOP_expand_array hypercall checks for whether FIFO event
channels are enabled, but without holding the correct lock. It can race
with EVTCHNOP_reset… |
CVE-2026-62431 | High | 7.5 | 2026-07-28 | The logic to handle periodic Viridian STIMERs performs a division with an
unchecked user-controlled divisor value, that can be set to zero to cause a #DE
fault. |
CVE-2026-62430 | High | 7.5 | 2026-07-28 | Accesses to the CMOS memory contents are done using an indirect IO port
pair. Therefore Xen needs to cache the guest chosen index, and one of
the usages of th… |
CVE-2026-62429 | Medium | 6.5 | 2026-07-28 | Accessing the vNUMA configuration data of a guest is still possible when
domain destruction has already started. The cleaning up of that
configuration informa… |
CVE-2026-62428 | High | 7.8 | 2026-07-28 | When grant-copy operations are processed, the respective grant may or may
not already be in use by another operation (a mapping or another copy).
For all copy… |
CVE-2026-62427 | High | 8.8 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To manage the system, sysctl… |
CVE-2026-62426 | High | 8.8 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To manage the system, sysctl… |
CVE-2026-62425 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge… |
CVE-2026-62424 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge… |
CVE-2026-62423 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge… |
CVE-2026-42495 | Medium | 5.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge… |
CVE-2026-42494 | Medium | 6.1 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge… |
CVE-2026-42493 | High | 7.5 | 2026-07-28 | Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costl… |
CVE-2026-42492 | High | 7.5 | 2026-07-28 | Xenstore, to have an up-to-date picture of the entire system, wants to
know of domains appearing and disappearing. To make this more robust, a
new XEN_DOMCTL_… |
CVE-2026-42486 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different u… |
CVE-2026-23562 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different u… |
CVE-2026-23561 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different u… |
CVE-2026-23560 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different u… |
CVE-2026-23559 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different… |
CVE-2026-23556 | | | 2026-07-09 | When oxenstored is tearing a domain down, the node data is cleaned up
but the usage counts are leaked.
When the domain ID is eventually reused, the new domain… |
CVE-2025-58151 | | | 2026-07-09 | varstored is a component of the Xapi toolstack handling UEFI Variables
for a VM. It has a communication path with OVMF inside the VM involving
mapping a buffe… |
CVE-2025-58146 | | | 2026-07-09 | There are multiple issues.
1. Updates to the XAPI database sanitise input strings, but try
generating the notification using the unsanitised input. This… |
CVE-2025-27464 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose… |
CVE-2025-27463 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose… |
CVE-2025-27462 | | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
The Windows PV drivers expos… |
CVE-2026-42490 | Medium | 6.5 | 2026-06-18 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To create and manage guests… |
CVE-2026-42489 | Medium | 5.3 | 2026-06-18 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To create and manage guests… |
CVE-2026-42488 | High | 8.1 | 2026-06-18 | Some shadow paging errors paths will switch the page-tables without
updating the currently running vCPU reference. This causes a mismatch
between the loaded p… |
CVE-2026-42487 | High | 7.9 | 2026-06-18 | HVM guest I/O port accesses are subject to either emulation or at least
translation. Translations are managed by the device model (via
XEN_DOMCTL_ioport_mappi… |
CVE-2026-23558 | High | 7.8 | 2026-05-19 | The adjustments made for XSA-379 as well as those subsequently becoming
XSA-387 still left a race window, when a HVM or PVH guest does a grant
table version ch… |
CVE-2026-23557 | Medium | 6.5 | 2026-05-19 | Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES
command within a transaction due to an assert() triggering.
In case xenstored was built w… |
CVE-2026-23555 | High | 7.1 | 2026-03-23 | Any guest issuing a Xenstore command accessing a node using the
(illegal) node path "/local/domain/", will crash xenstored due to a
clobbered error indicator i… |
CVE-2026-23554 | High | 7.8 | 2026-03-23 | The Intel EPT paging code uses an optimization to defer flushing of any cached
EPT state until the p2m lock is dropped, so that multiple modifications done
und… |
CVE-2026-23553 | Low | 2.9 | 2026-01-28 | In the context switch logic Xen attempts to skip an IBPB in the case of
a vCPU returning to a CPU on which it was the previous vCPU to run.
While safe for Xen'… |
CVE-2025-58150 | High | 8.8 | 2026-01-28 | Shadow mode tracing code uses a set of per-CPU variables to avoid
cumbersome parameter passing. Some of these variables are written to
with guest controlled d… |
CVE-2025-58149 | High | 7.5 | 2025-10-31 | When passing through PCI devices, the detach logic in libxl won't remove
access permissions to any 64bit memory BARs the device might have. As a
result a doma… |
CVE-2025-58148 | High | 7.5 | 2025-10-31 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
Some Viridian hypercalls can… |
CVE-2025-58147 | High | 7.5 | 2025-10-31 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
Some Viridian hypercalls can… |
CVE-2025-58145 | High | 7.5 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
There are two issues related… |
CVE-2025-58144 | High | 7.5 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
There are two issues related… |
CVE-2025-58143 | Critical | 9.8 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
There are multiple issues rel… |
CVE-2025-58142 | Critical | 9.8 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
There are multiple issues rel… |
CVE-2025-27466 | Critical | 9.8 | 2025-09-11 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
There are multiple issues rel… |
CVE-2025-1713 | High | 7.5 | 2025-07-17 | When setting up interrupt remapping for legacy PCI(-X) devices,
including PCI(-X) bridges, a lookup of the upstream bridge is required.
This lookup, itself inv… |
CVE-2025-27465 | Medium | 4.3 | 2025-07-16 | Certain instructions need intercepting and emulating by Xen. In some
cases Xen emulates the instruction by replaying it, using an executable
stub. Some instr… |
CVE-2024-31144 | Low | 3.8 | 2025-02-14 | For a brief summary of Xapi terminology, see:
https://xapi-project.github.io/xen-api/overview.html#object-model-overview
Xapi contains functionality to b… |
CVE-2024-2201 | Medium | 4.7 | 2024-12-19 | A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux ker… |
CVE-2024-45819 | Medium | 5.5 | 2024-12-19 | PVH guests have their ACPI tables constructed by the toolstack. The
construction involves building the tables in local memory, which are
then copied into gues… |
CVE-2024-45818 | Medium | 6.5 | 2024-12-19 | The hypervisor contains code to accelerate VGA memory accesses for HVM
guests, when the (virtual) VGA is in "standard" mode. Locking involved
there has an unu… |
CVE-2024-45817 | High | 7.3 | 2024-09-25 | In x86's APIC (Advanced Programmable Interrupt Controller) architecture,
error conditions are reported in a status register. Furthermore, the OS
can opt to re… |
CVE-2024-31146 | High | 7.5 | 2024-09-25 | When multiple devices share resources and one of them is to be passed
through to a guest, security of the entire system and of respective
guests individually c… |
CVE-2024-31145 | High | 7.5 | 2024-09-25 | Certain PCI devices in a system might be assigned Reserved Memory
Regions (specified via Reserved Memory Region Reporting, "RMRR") for
Intel VT-d or Unity Mapp… |
CVE-2024-31143 | High | 7.5 | 2024-07-18 | An optional feature of PCI MSI called "Multiple Message" allows a
device to use multiple consecutive interrupt vectors. Unlike for MSI-X,
the setting up of th… |
CVE-2024-31142 | High | 7.5 | 2024-05-16 | Because of a logical error in XSA-407 (Branch Type Confusion), the
mitigation is not applied properly when it is intended to be used.
XSA-434 (Speculative Retu… |
CVE-2023-46842 | Medium | 6.5 | 2024-05-16 | Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and
other modes. This in particular means that they may set registers used
to pass 32-bit… |
CVE-2023-46841 | Medium | 6.5 | 2024-03-20 | Recent x86 CPUs offer functionality named Control-flow Enforcement
Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS).
CET-SS is a hardware fe… |
CVE-2023-46840 | Medium | 4.1 | 2024-03-20 | Incorrect placement of a preprocessor directive in source code results
in logic that doesn't operate as intended when support for HVM guests is
compiled out of… |
CVE-2023-46839 | Medium | 5.3 | 2024-03-20 | PCI devices can make use of a functionality called phantom functions,
that when enabled allows the device to generate requests using the IDs
of functions that… |
CVE-2024-2193 | Medium | 5.7 | 2024-03-15 | A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclo… |
CVE-2023-46837 | Low | 3.3 | 2024-01-05 | Arm provides multiple helpers to clean & invalidate the cache
for a given region. This is, for instance, used when allocating
guest memory to ensure any write… |
CVE-2023-46836 | Medium | 4.7 | 2024-01-05 | The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative
Return Stack Overflow) are not IRQ-safe. It was believed that the
mitigations always op… |
CVE-2023-46835 | Medium | 5.5 | 2024-01-05 | The current setup of the quarantine page tables assumes that the
quarantine domain (dom_io) has been initialized with an address width
of DEFAULT_DOMAIN_ADDRES… |
CVE-2023-34328 | Medium | 5.5 | 2024-01-05 |
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
AMD CPUs since ~2014 have ex… |
CVE-2023-34327 | Medium | 5.5 | 2024-01-05 |
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
AMD CPUs since ~2014 have ex… |
CVE-2023-34326 | High | 7.8 | 2024-01-05 | The caching invalidation guidelines from the AMD-Vi specification (48882—Rev
3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction
(see… |
CVE-2023-34325 | High | 7.8 | 2024-01-05 |
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
libfsimage contains parsing… |
CVE-2023-34324 | Medium | 4.9 | 2024-01-05 | Closing of an event channel in the Linux kernel can result in a deadlock.
This happens when the close is being performed in parallel to an unrelated
Xen consol… |
CVE-2023-34323 | Medium | 5.5 | 2024-01-05 | When a transaction is committed, C Xenstored will first check
the quota is correct before attempting to commit any nodes. It would
be possible that accounting… |
CVE-2023-34322 | High | 7.8 | 2024-01-05 | For migration as well as to work around kernels unaware of L1TF (see
XSA-273), PV guests may be run in shadow paging mode. Since Xen itself
needs to be mapped… |
CVE-2023-34321 | Low | 3.3 | 2024-01-05 | Arm provides multiple helpers to clean & invalidate the cache
for a given region. This is, for instance, used when allocating
guest memory to ensure any write… |
CVE-2023-34320 | Medium | 5.5 | 2023-12-08 | Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412
where software, under certain circumstances, could deadlock a core
due to the execution of eit… |
CVE-2023-4949 | High | 8.1 | 2023-11-10 | An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploi… |
CVE-2023-34319 | High | 7.8 | 2023-09-22 | The fix for XSA-423 added logic to Linux'es netback driver to deal with
a frontend splitting a packet in a way such that not all of the headers
would come in o… |
CVE-2022-40982 | Medium | 6.5 | 2023-08-11 | Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an aut… |
CVE-2023-20588 | Medium | 5.5 | 2023-08-08 |
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.
|
CVE-2023-20593 | Medium | 5.5 | 2023-07-24 | An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. |
CVE-2022-4949 | High | 8.8 | 2023-06-07 | The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to… |
CVE-2022-42336 | Low | 3.3 | 2023-05-17 | Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting o… |
CVE-2022-42335 | High | 7.8 | 2023-04-25 | x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unav… |
CVE-2022-42334 | Medium | 6.5 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42333 | High | 8.6 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42332 | High | 7.8 | 2023-03-21 | x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavai… |
CVE-2022-42331 | Medium | 5.5 | 2023-03-21 | x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs… |
CVE-2022-42330 | High | 7.5 | 2023-01-26 | Guests can cause Xenstore crash via soft reset When a guest issues a "Soft Reset" (e.g. for performing a kexec) the libxl based Xen toolstack will normally per… |
CVE-2022-23824 | Medium | 5.5 | 2022-11-09 | IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. |
CVE-2022-42327 | High | 7.1 | 2022-11-01 | x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global share… |
CVE-2022-42326 | Medium | 5.5 | 2022-11-01 | Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/v… |
CVE-2022-42325 | Medium | 5.5 | 2022-11-01 | Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/v… |
CVE-2022-42324 | Medium | 5.5 | 2022-11-01 | Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the… |
CVE-2022-42323 | Medium | 5.5 | 2022-11-01 | Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulne… |
CVE-2022-42322 | Medium | 5.5 | 2022-11-01 | Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulne… |
CVE-2022-42321 | Medium | 6.5 | 2022-11-01 | Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xensto… |
CVE-2022-42320 | High | 7.0 | 2022-11-01 | Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenst… |
CVE-2022-42319 | Medium | 6.5 | 2022-11-01 | Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of… |
CVE-2022-42318 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42317 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |