CVE-2026-42487
x86 HVM I/O port list traversal
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
x86 HVM I/O port list traversal
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
- Record
CVE-2026-42487- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2026-37888
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
- Record
EUVD-2026-37888- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xx8x-hq3h-f37h
HVM guest I/O port accesses are subject to either emulation or at least translation. ...
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
- Record
GHSA-xx8x-hq3h-f37h- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
NVD
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
- Record
CVE-2026-42487- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-42487
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
- Record
ALPINE-CVE-2026-42487- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-42487
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
- Record
DEBIAN-CVE-2026-42487- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2026-42487
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
- Record
UBUNTU-CVE-2026-42487- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2026:2328-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2026-42487: x86 HVM I/O port list traversal (bsc#1266952).
- CVE-2026-42488: x86: mismatched mapcache metadata (bsc#1266955).
- CVE-2026-42489,CVE-2026-42490: domctl lock open to abuse (bsc#1266953).
- Record
SUSE-SU-2026:2328-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2329-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2026-42487: x86 HVM I/O port list traversal (bsc#1266952).
- CVE-2026-42488: x86: mismatched mapcache metadata (bsc#1266955).
- CVE-2026-42489,CVE-2026-42490: domctl lock open to abuse (bsc#1266953).
- Record
SUSE-SU-2026:2329-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2364-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2026-42487: x86 HVM I/O port list traversal (bsc#1266952).
- CVE-2026-42488: x86: mismatched mapcache metadata (bsc#1266955).
- CVE-2026-42489,CVE-2026-42490: domctl lock open to abuse (bsc#1266953).
- Record
SUSE-SU-2026:2364-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2613-1 No score
Security update for xen
This update for xen fixes the following issues
- CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264066).
- CVE-2026-42487: x86 HVM I/O port list traversal (bsc#1266952).
- CVE-2026-42488: x86: mismatched mapcache metadata (bsc#1266955).
- CVE-2026-42489,CVE-2026-42490: domctl lock open to abuse (bsc#1266953).
- Record
SUSE-SU-2026:2613-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2668-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2026-42487: xen: x86 HVM I/O port list traversal (XSA-491) (bsc#1266952).
- CVE-2026-42488: xen: x86: mismatched mapcache metadata (XSA-494) (bsc#1266955).
- CVE-2026-42489,CVE-2026-42490: xen: domctl lock open to abuse (XSA-492) (bsc#1266953).
- Record
SUSE-SU-2026:2668-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenAlpine:v3.20 |
before 4.18.5-r9 | 4.18.5-r9 |
xenAlpine:v3.21 |
before 4.19.5-r4 | 4.19.5-r4 |
xenAlpine:v3.22 |
before 4.20.3-r4 | 4.20.3-r4 |
xenAlpine:v3.23 |
before 4.20.3-r4 | 4.20.3-r4 |
xenAlpine:v3.24 |
before 4.21.1-r6 | 4.21.1-r6 |
xenDebian:12 |
before 4.17.7-0+deb12u1, plus listed versions 4.17.1+2-gb773c48e36-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1~deb12u14.17.2-1 Show 9 moreShow less4.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.14.17.3+10-g091466ba55-1.1~exp14.17.3+10-g091466ba55-1.1~exp24.17.3+10-g091466ba55-1~deb12u14.17.3+36-g54dacb5c02-14.17.5+23-ga4e5191dc0-14.17.5+23-ga4e5191dc0-1+deb12u14.17.5+72-g01140da4e8-1 |
4.17.7-0+deb12u1 |
xenDebian:13 |
before 4.20.3+127-gc42374a105-0+deb13u1, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+37-g61ff35323e-0+deb13u14.20.2+37-g61ff35323e-14.20.2+7-g1badcf5035-0+deb13u14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-2 |
4.20.3+127-gc42374a105-0+deb13u1 |
xenDebian:14 |
before 4.20.3+127-gc42374a105-1, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+37-g61ff35323e-14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-2 |
4.20.3+127-gc42374a105-1 |
xenSUSE:Linux Enterprise Micro 5.5 |
before 4.17.6_12-150500.3.73.1 | 4.17.6_12-150500.3.73.1 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 4.17.6_12-150500.3.73.1 | 4.17.6_12-150500.3.73.1 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xenSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 4.17.6_12-150500.3.73.1 | 4.17.6_12-150500.3.73.1 |
xenSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 4.17.6_12-150500.3.73.1 | 4.17.6_12-150500.3.73.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 4.17.6_12-150500.3.73.1 | 4.17.6_12-150500.3.73.1 |
xenSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 4.18.5_18-150600.3.50.1 | 4.18.5_18-150600.3.50.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 4.18.5_18-150600.3.50.1 | 4.18.5_18-150600.3.50.1 |
xenSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 4.20.3_06-150700.3.41.1 | 4.20.3_06-150700.3.41.1 |
xenSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 4.20.3_06-150700.3.41.1 | 4.20.3_06-150700.3.41.1 |
xenSUSE:Linux Enterprise Micro 5.3 |
before 4.16.7_10-150400.4.86.2 | 4.16.7_10-150400.4.86.2 |
xenSUSE:Linux Enterprise Micro 5.4 |
before 4.16.7_10-150400.4.86.2 | 4.16.7_10-150400.4.86.2 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 4.16.7_10-150400.4.86.2 | 4.16.7_10-150400.4.86.2 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 4.16.7_10-150400.4.86.2 | 4.16.7_10-150400.4.86.2 |
xenSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 4.16.7_10-150400.4.86.2 | 4.16.7_10-150400.4.86.2 |
xenSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 4.16.7_10-150400.4.86.2 | 4.16.7_10-150400.4.86.2 |
xenSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 4.12.4_70-3.145.1 | 4.12.4_70-3.145.1 |
xenSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 4.12.4_70-3.145.1 | 4.12.4_70-3.145.1 |
xenUbuntu:16.04:LTS |
All versions, plus listed versions 4.5.1-0ubuntu14.5.1-0ubuntu24.6.0-1ubuntu14.6.0-1ubuntu24.6.0-1ubuntu4 Show 7 moreShow less4.6.0-1ubuntu4.14.6.0-1ubuntu4.24.6.0-1ubuntu4.34.6.5-0ubuntu14.6.5-0ubuntu1.14.6.5-0ubuntu1.24.6.5-0ubuntu1.4 |
None known |
xenUbuntu:18.04:LTS |
All versions, plus listed versions 4.9.0-0ubuntu34.9.0-0ubuntu44.9.2-0ubuntu1 |
None known |
xenUbuntu:20.04:LTS |
All versions, plus listed versions 4.9.2-0ubuntu24.9.2-0ubuntu64.9.2-0ubuntu74.11.3+24-g14b62ab3e5-1ubuntu14.11.3+24-g14b62ab3e5-1ubuntu24.11.3+24-g14b62ab3e5-1ubuntu2.24.11.3+24-g14b62ab3e5-1ubuntu2.3 |
None known |
xenUbuntu:22.04:LTS |
All versions, plus listed versions 4.11.4+24-gddaaccbbab-1ubuntu24.16.0-1~ubuntu24.16.0-1~ubuntu2.1 |
None known |
xenUbuntu:24.04:LTS |
All versions, plus listed versions 4.17.2-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1ubuntu14.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.1ubuntu24.17.3+10-g091466ba55-1.1ubuntu3 |
None known |
xenUbuntu:25.10 |
All versions, plus listed versions 4.20.0-1ubuntu14.20.0+68-g35cb38b222-1 |
None known |
xenUbuntu:26.10 |
All versions, plus listed versions 4.20.2+7-g1badcf5035-2build24.20.2+37-g61ff35323e-1ubuntu14.20.3+127-gc42374a105-1 |
None known |
xenUbuntu:26.04:LTS |
All versions, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+7-g1badcf5035-24.20.2+7-g1badcf5035-2build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42487 is a high vulnerability (CVSS 7.9) in Xen, published June 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. Fixed in xen 4.18.5-r9.
References
xenbits.xenproject.org/xsa/advisory-491.html
xenbits.xen.org/xsa/advisory-491.html
openwall.com/lists/oss-security/2026/06/09/11
nvd.nist.gov/vuln/detail/CVE-2026-42487
github.com/advisories/GHSA-xx8x-hq3h-f37h
security.alpinelinux.org/vuln/CVE-2026-42487
Show 17 moreShow less
security-tracker.debian.org/tracker/CVE-2026-42487
suse.com/support/update/announcement/2026/suse-su-20262328-1
bugzilla.suse.com/1266952
ubuntu.com/security/CVE-2026-42487
cve.org/CVERecord?id=CVE-2026-42487