CVE-2026-62437
x86: DMs may cause mem leak by IRQ binding
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
6.5
x86: DMs may cause mem leak by IRQ binding
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
- Record
CVE-2026-62437- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2026-72719
6.5
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
- Record
EUVD-2026-72719- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vfxv-3qcw-g966
6.5
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI...
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
- Record
GHSA-vfxv-3qcw-g966- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
NVD
6.5
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
- Record
CVE-2026-62437- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-62437
6.5
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
- Record
ALPINE-CVE-2026-62437- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-62437
6.5
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
- Record
DEBIAN-CVE-2026-62437- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-04
Show 6 moreShow less
OSVUBUNTU-CVE-2026-62437
6.5
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
- Record
UBUNTU-CVE-2026-62437- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11738-1 No score
xen-4.22.0_04-1.1 on GA media
These are all security issues fixed in the xen-4.22.0_04-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11738-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4087-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).
- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).
- Record
SUSE-SU-2026:4087-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4088-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).
- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).
- Record
SUSE-SU-2026:4088-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4089-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).
- Record
SUSE-SU-2026:4089-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4090-1 No score
Security update for xen
This update for xen fixes the following issues:
Update to version 4.20.3 (jsc#PED-8907).
Security issues fixed:
- CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528).
- CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling (bsc#1271530).
- CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531).
- CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532).
- CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534).
- CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535).
- CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536).
- CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537).
- CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538).
- CVE-2026-62434: PoD: Don't try to reclaim special pages (bsc#1271539).
- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).
- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).
- pygrub is only supported in de-privileged mode (bsc#1271947).
Non security issue fixed:
- Xen: Missing upstream bug fixes (bsc#1027519).
- Record
SUSE-SU-2026:4090-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenAlpine:v3.21 |
before 4.19.6-r1 | 4.19.6-r1 |
xenAlpine:v3.22 |
before 4.20.4-r1 | 4.20.4-r1 |
xenAlpine:v3.23 |
before 4.20.4-r1 | 4.20.4-r1 |
xenAlpine:v3.24 |
before 4.21.2-r1 | 4.21.2-r1 |
xenDebian:12 |
before 4.17.7+13-g2445b30a44-0+deb12u1, plus listed versions 4.17.1+2-gb773c48e36-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1~deb12u14.17.2-1 Show 10 moreShow less4.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.14.17.3+10-g091466ba55-1.1~exp14.17.3+10-g091466ba55-1.1~exp24.17.3+10-g091466ba55-1~deb12u14.17.3+36-g54dacb5c02-14.17.5+23-ga4e5191dc0-14.17.5+23-ga4e5191dc0-1+deb12u14.17.5+72-g01140da4e8-14.17.7-0+deb12u1 |
4.17.7+13-g2445b30a44-0+deb12u1 |
xenDebian:13 |
before 4.20.4+39-gf1e1321c87-0+deb13u1, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+37-g61ff35323e-0+deb13u14.20.2+37-g61ff35323e-14.20.2+7-g1badcf5035-0+deb13u14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-24.20.3+127-gc42374a105-0+deb13u14.20.3+127-gc42374a105-1 |
4.20.4+39-gf1e1321c87-0+deb13u1 |
xenDebian:14 |
before 4.20.4+39-gf1e1321c87-1, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+37-g61ff35323e-14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-24.20.3+127-gc42374a105-1 |
4.20.4+39-gf1e1321c87-1 |
xenSUSE:Linux Enterprise Micro 5.5 |
before 4.17.6_16-150500.3.79.1 | 4.17.6_16-150500.3.79.1 |
xenSUSE:Linux Enterprise Micro 5.3 |
before 4.16.7_14-150400.4.92.1 | 4.16.7_14-150400.4.92.1 |
xenSUSE:Linux Enterprise Micro 5.4 |
before 4.16.7_14-150400.4.92.1 | 4.16.7_14-150400.4.92.1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xenSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 4.12.4_74-3.151.1 | 4.12.4_74-3.151.1 |
xenSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 4.20.4_04-150700.3.46.1 | 4.20.4_04-150700.3.46.1 |
xenSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 4.20.4_04-150700.3.46.1 | 4.20.4_04-150700.3.46.1 |
xenUbuntu:16.04:LTS |
All versions, plus listed versions 4.5.1-0ubuntu14.5.1-0ubuntu24.6.0-1ubuntu14.6.0-1ubuntu24.6.0-1ubuntu4 Show 7 moreShow less4.6.0-1ubuntu4.14.6.0-1ubuntu4.24.6.0-1ubuntu4.34.6.5-0ubuntu14.6.5-0ubuntu1.14.6.5-0ubuntu1.24.6.5-0ubuntu1.4 |
None known |
xenUbuntu:18.04:LTS |
All versions, plus listed versions 4.9.0-0ubuntu34.9.0-0ubuntu44.9.2-0ubuntu1 |
None known |
xenUbuntu:20.04:LTS |
All versions, plus listed versions 4.9.2-0ubuntu24.9.2-0ubuntu64.9.2-0ubuntu74.11.3+24-g14b62ab3e5-1ubuntu14.11.3+24-g14b62ab3e5-1ubuntu24.11.3+24-g14b62ab3e5-1ubuntu2.24.11.3+24-g14b62ab3e5-1ubuntu2.3 |
None known |
xenUbuntu:22.04:LTS |
All versions, plus listed versions 4.11.4+24-gddaaccbbab-1ubuntu24.16.0-1~ubuntu24.16.0-1~ubuntu2.1 |
None known |
xenUbuntu:24.04:LTS |
All versions, plus listed versions 4.17.2-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1ubuntu14.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.1ubuntu24.17.3+10-g091466ba55-1.1ubuntu3 |
None known |
xenUbuntu:26.10 |
All versions, plus listed versions 4.20.2+7-g1badcf5035-2build24.20.2+37-g61ff35323e-1ubuntu14.20.3+127-gc42374a105-1 |
None known |
xenUbuntu:26.04:LTS |
All versions, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+7-g1badcf5035-24.20.2+7-g1badcf5035-2build2 |
None known |
xenopenSUSE:Tumbleweed |
before 4.22.0_04-1.1 | 4.22.0_04-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-62437 is a medium vulnerability (CVSS 6.5) in Xen, published September 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. Fixed in xen 4.19.6-r1.
References
xenbits.xenproject.org/xsa/advisory-509.html
xenbits.xen.org/xsa/advisory-509.html
openwall.com/lists/oss-security/2026/09/08/6
nvd.nist.gov/vuln/detail/CVE-2026-62437
github.com/advisories/GHSA-vfxv-3qcw-g966
security.alpinelinux.org/vuln/CVE-2026-62437
Show 41 moreShow less
security-tracker.debian.org/tracker/CVE-2026-62437
suse.com/support/update/announcement/2026/suse-su-20264087-1
bugzilla.suse.com/1276838
bugzilla.suse.com/1276839
bugzilla.suse.com/1276841
suse.com/security/cve/CVE-2026-62437
suse.com/security/cve/CVE-2026-79602
suse.com/security/cve/CVE-2026-79603
suse.com/support/update/announcement/2026/suse-su-20264088-1
suse.com/support/update/announcement/2026/suse-su-20264089-1
suse.com/support/update/announcement/2026/suse-su-20264090-1
bugzilla.suse.com/1027519
bugzilla.suse.com/1271528
bugzilla.suse.com/1271530
bugzilla.suse.com/1271531
bugzilla.suse.com/1271532
bugzilla.suse.com/1271533
bugzilla.suse.com/1271534
bugzilla.suse.com/1271535
bugzilla.suse.com/1271536
bugzilla.suse.com/1271537
bugzilla.suse.com/1271538
bugzilla.suse.com/1271539
bugzilla.suse.com/1271947
suse.com/security/cve/CVE-2026-42493
suse.com/security/cve/CVE-2026-42494
suse.com/security/cve/CVE-2026-42495
suse.com/security/cve/CVE-2026-62423
suse.com/security/cve/CVE-2026-62424
suse.com/security/cve/CVE-2026-62425
suse.com/security/cve/CVE-2026-62426
suse.com/security/cve/CVE-2026-62427
suse.com/security/cve/CVE-2026-62428
suse.com/security/cve/CVE-2026-62429
suse.com/security/cve/CVE-2026-62430
suse.com/security/cve/CVE-2026-62431
suse.com/security/cve/CVE-2026-62432
suse.com/security/cve/CVE-2026-62433
suse.com/security/cve/CVE-2026-62434
ubuntu.com/security/CVE-2026-62437
cve.org/CVERecord?id=CVE-2026-62437