{"id":"CVE-2026-23553","aliases":["ALPINE-CVE-2026-23553","DEBIAN-CVE-2026-23553","EUVD-2026-4882","GHSA-pxqc-5jg3-xfqm","MGASA-2026-0026","SUSE-SU-2026:0303-1","SUSE-SU-2026:0304-1","SUSE-SU-2026:0306-1","SUSE-SU-2026:0328-1","SUSE-SU-2026:0329-1","SUSE-SU-2026:0394-1","SUSE-SU-2026:0589-1","UBUNTU-CVE-2026-23553","openSUSE-SU-2026:10118-1"],"status":"published","title":"x86: incomplete IBPB for vCPU isolation","description":"In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks.  Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A.  Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00145,"percentile":0.03816,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-665","CWE-693"],"published":"2026-01-27T16:14:45Z","modified":"2026-10-17T12:58:07Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.18.5-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.19.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.20.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.20.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.21.0-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.17.7-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.20.2+37-g61ff35323e-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.20.2+37-g61ff35323e-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.18.5-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.19.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.20.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.20.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.21.0-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7-0+deb12u1"}]}],"versions":["4.17.1+2-gb773c48e36-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1~deb12u1","4.17.2-1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1","4.17.3+10-g091466ba55-1.1~exp1","4.17.3+10-g091466ba55-1.1~exp2","4.17.3+10-g091466ba55-1~deb12u1","4.17.3+36-g54dacb5c02-1","4.17.5+23-ga4e5191dc0-1","4.17.5+23-ga4e5191dc0-1+deb12u1","4.17.5+72-g01140da4e8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.2+37-g61ff35323e-0+deb13u1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-0+deb13u1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2"]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.2+37-g61ff35323e-1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.5-1.git20251028.2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.6_28-150300.3.94.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.6_04-150500.3.59.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.5_10-150600.3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_64-3.137.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.2_04-150700.3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.2_04-150700.3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_06-150400.4.78.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_06-150400.4.78.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.2_06-150700.3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.2_06-150700.3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2","4.11.3+24-g14b62ab3e5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4+24-gddaaccbbab-1ubuntu2","4.16.0-1~ubuntu2","4.16.0-1~ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.2-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1ubuntu1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1ubuntu2","4.17.3+10-g091466ba55-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0-1ubuntu1","4.20.0+68-g35cb38b222-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.2+7-g1badcf5035-2build2","4.20.2+37-g61ff35323e-1ubuntu1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-2","4.20.2+7-g1badcf5035-2build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.0_04-1.1"}]}],"bundled":2}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-479.html","tags":["Mitigation","Patch","Vendor Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2026/01/27/3","tags":["Mailing List","Mitigation","Patch","Third Party Advisory","fix"]},{"url":"http://xenbits.xen.org/xsa/advisory-479.html","tags":["Mitigation","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23553"},{"url":"https://github.com/advisories/GHSA-pxqc-5jg3-xfqm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-23553","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-23553","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0026.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35074","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/27/1","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/27/3","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260303-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248807","tags":["report"]},{"url":"https://bugzilla.suse.com/1252692","tags":["report"]},{"url":"https://bugzilla.suse.com/1254180","tags":["report"]},{"url":"https://bugzilla.suse.com/1256745","tags":["report"]},{"url":"https://bugzilla.suse.com/1256747","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23553","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260304-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260306-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260328-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260329-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260394-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260589-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23553","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23553","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-479.html","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-23553","title":"x86: incomplete IBPB for vCPU isolation","description":"In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks.  Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A.  Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB.","status":"published","published":"2026-01-28T15:33:44.782Z","modified":"2026-01-28T16:41:14.803Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-665","CWE-693"],"updated_at":"2026-11-02T13:42:26.790871Z"}],"euvd":[{"id":"EUVD-2026-4882","description":"In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks.  Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A.  Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB.","status":"published","published":"2026-01-28T15:33:44Z","modified":"2026-01-28T16:41:14Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:48:46.416428Z"}],"ghsa":[{"id":"GHSA-pxqc-5jg3-xfqm","title":"In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU...","description":"In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks.  Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A.  Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB.","status":"published","published":"2026-01-28T18:30:47Z","modified":"2026-01-28T18:30:53Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T15:05:57.071513Z"}],"nvd":[{"id":"CVE-2026-23553","description":"In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks.  Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A.  Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB.","status":"published","published":"2026-01-28T16:16:16.853Z","modified":"2026-06-17T10:21:46.19Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-665","CWE-693"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"ALPINE-CVE-2026-23553","description":"In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks.  Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A.  Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB.","status":"published","published":"2026-01-28T16:16:16.853Z","modified":"2026-10-01T02:17:49.210413614Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2026-23553","description":"In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks.  Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A.  Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB.","status":"published","published":"2026-01-28T16:16:16.853Z","modified":"2026-04-16T04:34:14.497309912Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"DEBIAN-CVE-2026-23553","description":"In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks.  Consider:   1) vCPU runs on CPU A, running task 1.  2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.  3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.  4) vCPU moves back to CPU A.  Xen skips IBPB again.  Now, task 2 is running on CPU A with task 1's training still in the BTB.","status":"published","published":"2026-01-28T16:16:16.853Z","modified":"2026-10-04T22:00:08.021895089Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:53.516942Z"},{"id":"UBUNTU-CVE-2026-23553","description":"In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks.  Consider:  1) vCPU runs on CPU A, running task 1.  2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.  3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.  4) vCPU moves back to CPU A.  Xen skips IBPB again. Now, task 2 is running on CPU A with task 1's training still in the BTB.","status":"published","published":"2026-01-28T16:16:00Z","modified":"2026-10-17T12:58:07.317596123Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:04.456047Z"},{"id":"MGASA-2026-0026","title":"Updated xen packages fix security vulnerabilities","description":"x86: buffer overrun with shadow paging + tracing. (CVE-2025-58150)\nx86: incomplete IBPB for vCPU isolation. (CVE-2026-23553)\n","status":"published","published":"2026-01-30T00:39:37Z","modified":"2026-04-16T04:41:38.429839915Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10118-1","title":"xen-4.21.0_04-1.1 on GA media","description":"These are all security issues fixed in the xen-4.21.0_04-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-29T00:00:00Z","modified":"2026-03-23T04:54:28.908742Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2026:0303-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity fixes:\n  \n- CVE-2025-58150: Fixed buffer overrun with shadow paging and \n  tracing (XSA-477) (bsc#1256745)\n- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation \n  (XSA-479) (bsc#1256747)\n- CVE-2025-58149: Fixed incorrect removal od permissions on PCI\n  device unplug allow PV guests to access memory of devices no \n  longer assigned to it (XSA-476) (bsc#1252692)\n- CVE-2025-27466, CVE-2025-58142, CVE-2025-58143: Fixed multiple\n  vulnerabilities in the Viridian interface (XSA-472) (bsc#1248807)\n\nOther fixes:\n\n- Fixed virtxend service restart. Caused by a failure to start \n  xenstored (bsc#1254180)\n","status":"published","published":"2026-01-27T16:14:45Z","modified":"2026-03-23T04:52:06.998777Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0304-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2025-58150: Fixed buffer overrun with shadow paging and \n  tracing (XSA-477) (bsc#1256745)\n- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation \n  (XSA-479) (bsc#1256747)\n","status":"published","published":"2026-01-27T16:14:51Z","modified":"2026-03-23T04:52:07.098126Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0306-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2025-58150: Fixed buffer overrun with shadow paging and \n  tracing (XSA-477) (bsc#1256745)\n- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation \n  (XSA-479) (bsc#1256747)\n","status":"published","published":"2026-01-27T16:15:19Z","modified":"2026-03-23T04:50:24.363666Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0328-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity fixes:\n  \n- CVE-2025-58150: Fixed buffer overrun with shadow paging and \n  tracing (XSA-477) (bsc#1256745)\n- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation \n  (XSA-479) (bsc#1256747)\n- CVE-2025-58149: Fixed incorrect removal od permissions on PCI\n  device unplug allow PV guests to access memory of devices no \n  longer assigned to it (XSA-476) (bsc#1252692)\n","status":"published","published":"2026-01-28T15:39:28Z","modified":"2026-03-23T04:52:08.599797Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0329-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2025-58150: Fixed buffer overrun with shadow paging and \n  tracing (XSA-477) (bsc#1256745)\n- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation \n  (XSA-479) (bsc#1256747)\n","status":"published","published":"2026-01-28T15:39:40Z","modified":"2026-03-23T04:52:08.843134Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0394-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity fixes:\n  \n- CVE-2025-58150: Fixed buffer overrun with shadow paging and \n  tracing (XSA-477) (bsc#1256745)\n- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation \n  (XSA-479) (bsc#1256747)\n- CVE-2025-58149: Fixed incorrect removal od permissions on PCI\n  device unplug allow PV guests to access memory of devices no \n  longer assigned to it (XSA-476) (bsc#1252692)\n\nOther fixes:\n\n- Fixed virtxend service restart. Caused by a failure to start \n  xenstored (bsc#1254180)\n","status":"published","published":"2026-02-05T15:42:11Z","modified":"2026-02-07T14:00:14.638921Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0589-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2025-58150: buffer overrun with shadow paging + tracing (XSA-477) (bsc#1256745).\n- CVE-2026-23553: incomplete IBPB for vCPU isolation (XSA-479) (bsc#1256747).\n","status":"published","published":"2026-02-20T10:05:27Z","modified":"2026-03-23T04:52:23.315956Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}