CVE-2026-23558

The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of the status pages may then be freed while mappings of them would still be inserted into the guest's secondary (P2M) page tables.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.1 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://xenbits.xenproject.org/xsa/advisory-486.html	Mitigation Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/28/13	Mailing List Mitigation Patch Third Party Advisory
http://xenbits.xen.org/xsa/advisory-486.html	Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Los ajustes realizados para XSA-379, así como aquellos que posteriormente se convirtieron en XSA-387, aún dejaban una ventana de carrera, cuando un invitado HVM o PVH realiza un cambio de versión de tabla de concesión de v2 a v1 en paralelo con el mapeo de la(s) página(s) de estado a través de XENMEM_add_to_physmap. Algunas de las páginas de estado pueden entonces ser liberadas mientras los mapeos de estas aún estarían insertados en las tablas de páginas secundarias (P2M) del invitado.

Information

Published : 2026-05-19 14:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-23558

Mitre link : CVE-2026-23558

CVE.ORG link : CVE-2026-23558

JSON object : View

Products Affected

xen

xen

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-23558", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23558", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}]}, "affected": [{"source": "security@xen.org", "affectedData": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-486"}], "defaultStatus": "unknown"}]}], "published": "2026-05-19T14:16:38.960", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-486.html", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security@xen.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/28/13", "tags": ["Mailing List", "Mitigation", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://xenbits.xen.org/xsa/advisory-486.html", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "The adjustments made for XSA-379 as well as those subsequently becoming\nXSA-387 still left a race window, when a HVM or PVH guest does a grant\ntable version change from v2 to v1 in parallel with mapping the status\npage(s) via XENMEM_add_to_physmap. Some of the status pages may then be\nfreed while mappings of them would still be inserted into the guest's\nsecondary (P2M) page tables."}, {"lang": "es", "value": "Los ajustes realizados para XSA-379, as\u00ed como aquellos que posteriormente se convirtieron en XSA-387, a\u00fan dejaban una ventana de carrera, cuando un invitado HVM o PVH realiza un cambio de versi\u00f3n de tabla de concesi\u00f3n de v2 a v1 en paralelo con el mapeo de la(s) p\u00e1gina(s) de estado a trav\u00e9s de XENMEM_add_to_physmap. Algunas de las p\u00e1ginas de estado pueden entonces ser liberadas mientras los mapeos de estas a\u00fan estar\u00edan insertados en las tablas de p\u00e1ginas secundarias (P2M) del invitado."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E095C1C-0DC6-4380-9333-477B13273E9E", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@xen.org"}