CVE-2026-79602

x86: improper handling of HVM emulation return codes

8.8 HighFix available

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.12%Unchanged since Sep 9, 2026

What each source reports

CVE List Score used 8.8

x86: improper handling of HVM emulation return codes

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Record: CVE-2026-79602
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

EUVDEUVD-2026-72720 8.8

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Record: EUVD-2026-72720
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-626m-h7vc-vwvc 8.8

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG...

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Record: GHSA-626m-h7vc-vwvc
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

NVD 8.8

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Record: CVE-2026-79602
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSVALPINE-CVE-2026-79602 8.8

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Record: ALPINE-CVE-2026-79602
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-79602 8.8

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Record: DEBIAN-CVE-2026-79602
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-04

Show 6 moreShow less

OSVUBUNTU-CVE-2026-79602 8.8

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Record: UBUNTU-CVE-2026-79602
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11738-1 No score

xen-4.22.0_04-1.1 on GA media

These are all security issues fixed in the xen-4.22.0_04-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11738-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4087-1 No score

Security update for xen

This update for xen fixes the following issues:

CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).
CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).

Record: SUSE-SU-2026:4087-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4088-1 No score

Security update for xen

This update for xen fixes the following issues:

CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).
CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).

Record: SUSE-SU-2026:4088-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4089-1 No score

Security update for xen

This update for xen fixes the following issues:

CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).

Record: SUSE-SU-2026:4089-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4090-1 No score

Security update for xen

This update for xen fixes the following issues:

Update to version 4.20.3 (jsc#PED-8907).

Security issues fixed:

CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528).
CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling (bsc#1271530).
CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531).
CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532).
CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534).
CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535).
CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536).
CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537).
CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538).
CVE-2026-62434: PoD: Don't try to reclaim special pages (bsc#1271539).
CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).
CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).
pygrub is only supported in de-privileged mode (bsc#1271947).

Non security issue fixed:

Xen: Missing upstream bug fixes (bsc#1027519).

Record: SUSE-SU-2026:4090-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`xen` Alpine:v3.21	before 4.19.6-r1	4.19.6-r1
`xen` Alpine:v3.22	before 4.20.4-r1	4.20.4-r1
`xen` Alpine:v3.23	before 4.20.4-r1	4.20.4-r1
`xen` Alpine:v3.24	before 4.21.2-r1	4.21.2-r1
`xen` Debian:12	before 4.17.7+13-g2445b30a44-0+deb12u1, plus listed versions 4.17.1+2-gb773c48e36-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1~deb12u14.17.2-1 Show 10 moreShow less 4.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.14.17.3+10-g091466ba55-1.1~exp14.17.3+10-g091466ba55-1.1~exp24.17.3+10-g091466ba55-1~deb12u14.17.3+36-g54dacb5c02-14.17.5+23-ga4e5191dc0-14.17.5+23-ga4e5191dc0-1+deb12u14.17.5+72-g01140da4e8-14.17.7-0+deb12u1	4.17.7+13-g2445b30a44-0+deb12u1
`xen` Debian:13	before 4.20.4+39-gf1e1321c87-0+deb13u1, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+37-g61ff35323e-0+deb13u14.20.2+37-g61ff35323e-14.20.2+7-g1badcf5035-0+deb13u14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-24.20.3+127-gc42374a105-0+deb13u14.20.3+127-gc42374a105-1	4.20.4+39-gf1e1321c87-0+deb13u1
`xen` Debian:14	before 4.20.4+39-gf1e1321c87-1, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+37-g61ff35323e-14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-24.20.3+127-gc42374a105-1	4.20.4+39-gf1e1321c87-1
`xen` SUSE:Linux Enterprise Micro 5.5 From an advisory covering 3 CVEs	before 4.17.6_16-150500.3.79.1	4.17.6_16-150500.3.79.1
`xen` SUSE:Linux Enterprise Micro 5.3 From an advisory covering 3 CVEs	before 4.16.7_14-150400.4.92.1	4.16.7_14-150400.4.92.1
`xen` SUSE:Linux Enterprise Micro 5.4 From an advisory covering 3 CVEs	before 4.16.7_14-150400.4.92.1	4.16.7_14-150400.4.92.1

Show 11 moreShow less

Affected packages
Package	Affected	Fixed
`xen` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs	before 4.12.4_74-3.151.1	4.12.4_74-3.151.1
`xen` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 18 CVEs	before 4.20.4_04-150700.3.46.1	4.20.4_04-150700.3.46.1
`xen` SUSE:Linux Enterprise Module for Server Applications 15 SP7 From an advisory covering 18 CVEs	before 4.20.4_04-150700.3.46.1	4.20.4_04-150700.3.46.1
`xen` Ubuntu:16.04:LTS	All versions, plus listed versions 4.5.1-0ubuntu14.5.1-0ubuntu24.6.0-1ubuntu14.6.0-1ubuntu24.6.0-1ubuntu4 Show 7 moreShow less 4.6.0-1ubuntu4.14.6.0-1ubuntu4.24.6.0-1ubuntu4.34.6.5-0ubuntu14.6.5-0ubuntu1.14.6.5-0ubuntu1.24.6.5-0ubuntu1.4	None known
`xen` Ubuntu:18.04:LTS	All versions, plus listed versions 4.9.0-0ubuntu34.9.0-0ubuntu44.9.2-0ubuntu1	None known
`xen` Ubuntu:20.04:LTS	All versions, plus listed versions 4.9.2-0ubuntu24.9.2-0ubuntu64.9.2-0ubuntu74.11.3+24-g14b62ab3e5-1ubuntu14.11.3+24-g14b62ab3e5-1ubuntu24.11.3+24-g14b62ab3e5-1ubuntu2.24.11.3+24-g14b62ab3e5-1ubuntu2.3	None known
`xen` Ubuntu:22.04:LTS	All versions, plus listed versions 4.11.4+24-gddaaccbbab-1ubuntu24.16.0-1~ubuntu24.16.0-1~ubuntu2.1	None known
`xen` Ubuntu:24.04:LTS	All versions, plus listed versions 4.17.2-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1ubuntu14.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.1ubuntu24.17.3+10-g091466ba55-1.1ubuntu3	None known
`xen` Ubuntu:26.10	All versions, plus listed versions 4.20.2+7-g1badcf5035-2build24.20.2+37-g61ff35323e-1ubuntu14.20.3+127-gc42374a105-1	None known
`xen` Ubuntu:26.04:LTS	All versions, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+7-g1badcf5035-24.20.2+7-g1badcf5035-2build2	None known
`xen` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 4.22.0_04-1.1	4.22.0_04-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 4, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-79602 is a high vulnerability (CVSS 8.8) in Xen, published September 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in xen 4.19.6-r1.

References

Show 41 moreShow less