{"id":"CVE-2026-23557","aliases":["ALPINE-CVE-2026-23557","DEBIAN-CVE-2026-23557","EUVD-2026-30925","GHSA-9879-vj7m-r497","SUSE-SU-2026:1645-1","SUSE-SU-2026:1657-1","SUSE-SU-2026:1692-1","SUSE-SU-2026:1743-1","SUSE-SU-2026:1998-1","SUSE-SU-2026:2066-1","SUSE-SU-2026:2102-1","UBUNTU-CVE-2026-23557","openSUSE-SU-2026:10660-1"],"status":"published","title":"Xenstored DoS via XS_RESET_WATCHES command","description":"Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES\ncommand within a transaction due to an assert() triggering.\n\nIn case xenstored was built with NDEBUG #defined nothing bad will\nhappen, as assert() is doing nothing in this case. Note that the\ndefault is not to define NDEBUG for xenstored builds even in release\nbuilds of Xen.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00158,"percentile":0.04997,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2026-04-28T14:46:52Z","modified":"2026-10-17T12:58:07Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.18.5-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.19.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.20.3-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.20.3-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.21.1-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.17.7-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.20.3+127-gc42374a105-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.20.3+127-gc42374a105-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.18.5-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.19.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.20.3-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.20.3-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.21.1-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7-0+deb12u1"}]}],"versions":["4.17.1+2-gb773c48e36-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1~deb12u1","4.17.2-1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1","4.17.3+10-g091466ba55-1.1~exp1","4.17.3+10-g091466ba55-1.1~exp2","4.17.3+10-g091466ba55-1~deb12u1","4.17.3+36-g54dacb5c02-1","4.17.5+23-ga4e5191dc0-1","4.17.5+23-ga4e5191dc0-1+deb12u1","4.17.5+72-g01140da4e8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3+127-gc42374a105-0+deb13u1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-0+deb13u1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-0+deb13u1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2"]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3+127-gc42374a105-1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2","4.11.3+24-g14b62ab3e5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4+24-gddaaccbbab-1ubuntu2","4.16.0-1~ubuntu2","4.16.0-1~ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.2-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1ubuntu1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1ubuntu2","4.17.3+10-g091466ba55-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0-1ubuntu1","4.20.0+68-g35cb38b222-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.2+7-g1badcf5035-2build2","4.20.2+37-g61ff35323e-1ubuntu1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-2","4.20.2+7-g1badcf5035-2build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.1_04-1.1"}]}],"bundled":2}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-484.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/28/11","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-484.html","tags":["Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23557"},{"url":"https://github.com/advisories/GHSA-9879-vj7m-r497"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-23557","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-23557","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261645-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262178","tags":["report"]},{"url":"https://bugzilla.suse.com/1262180","tags":["report"]},{"url":"https://bugzilla.suse.com/1262428","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23558","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261657-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261692-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261743-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261998-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264066","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54518","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262066-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262102-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-23557","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23557","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-484.html","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-23557","title":"Xenstored DoS via XS_RESET_WATCHES command","description":"Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES\ncommand within a transaction due to an assert() triggering.\n\nIn case xenstored was built with NDEBUG #defined nothing bad will\nhappen, as assert() is doing nothing in this case. Note that the\ndefault is not to define NDEBUG for xenstored builds even in release\nbuilds of Xen.","status":"published","published":"2026-05-19T12:49:42.202Z","modified":"2026-05-19T14:42:45.464Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T13:42:26.790871Z"}],"euvd":[{"id":"EUVD-2026-30925","description":"Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES\ncommand within a transaction due to an assert() triggering.\n\nIn case xenstored was built with NDEBUG #defined nothing bad will\nhappen, as assert() is doing nothing in this case. Note that the\ndefault is not to define NDEBUG for xenstored builds even in release\nbuilds of Xen.","status":"published","published":"2026-05-19T12:49:42Z","modified":"2026-05-19T14:42:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:21:15.688012Z"}],"ghsa":[{"id":"GHSA-9879-vj7m-r497","title":"Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES\ncommand within a transaction...","description":"Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES\ncommand within a transaction due to an assert() triggering.\n\nIn case xenstored was built with NDEBUG #defined nothing bad will\nhappen, as assert() is doing nothing in this case. Note that the\ndefault is not to define NDEBUG for xenstored builds even in release\nbuilds of Xen.","status":"published","published":"2026-05-19T15:31:29Z","modified":"2026-05-19T18:33:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:08:12.634242Z"}],"nvd":[{"id":"CVE-2026-23557","description":"Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES\ncommand within a transaction due to an assert() triggering.\n\nIn case xenstored was built with NDEBUG #defined nothing bad will\nhappen, as assert() is doing nothing in this case. Note that the\ndefault is not to define NDEBUG for xenstored builds even in release\nbuilds of Xen.","status":"published","published":"2026-05-19T14:16:38.817Z","modified":"2026-10-14T20:10:00.19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:12:19.752984Z"}],"osv":[{"id":"ALPINE-CVE-2026-23557","description":"Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES\ncommand within a transaction due to an assert() triggering.\n\nIn case xenstored was built with NDEBUG #defined nothing bad will\nhappen, as assert() is doing nothing in this case. Note that the\ndefault is not to define NDEBUG for xenstored builds even in release\nbuilds of Xen.","status":"published","published":"2026-05-19T14:16:38.817Z","modified":"2026-10-01T02:17:49.211641809Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"DEBIAN-CVE-2026-23557","description":"Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering.  In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen.","status":"published","published":"2026-05-19T14:16:38.817Z","modified":"2026-10-15T09:47:35.636210013Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:53.516942Z"},{"id":"UBUNTU-CVE-2026-23557","description":"Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen.","status":"published","published":"2026-05-19T14:16:00Z","modified":"2026-10-17T12:58:07.67312163Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:04.456047Z"},{"id":"openSUSE-SU-2026:10660-1","title":"xen-4.21.1_04-1.1 on GA media","description":"These are all security issues fixed in the xen-4.21.1_04-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-29T00:00:00Z","modified":"2026-04-30T08:15:34.786695Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2026:1645-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2025-54505: floating point divider state sampling on AMD CPUs AMD-SN-7053 (bsc#1262428).\n- CVE-2026-23557: Xenstored DoS via XS_RESET_WATCHES command (bsc#1262178).\n- CVE-2026-23558: grant table v2 race in status page mapping (bsc#1262180).\n","status":"published","published":"2026-04-28T14:46:52Z","modified":"2026-04-29T08:01:00.141129Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1657-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2025-54505: floating point divider state sampling on AMD CPUs AMD-SN-7053 (bsc#1262428).\n- CVE-2026-23557: Xenstored DoS via XS_RESET_WATCHES command (bsc#1262178).\n- CVE-2026-23558: grant table v2 race in status page mapping (bsc#1262180).\n","status":"published","published":"2026-04-29T11:06:54Z","modified":"2026-04-30T08:16:10.457563Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1692-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2025-54505: Floating Point Divider State Sampling on AMD CPUs AMD-SN-7053 (bsc#1262428).\n- CVE-2026-23557: Xenstored DoS via XS_RESET_WATCHES command (bsc#1262178).\n- CVE-2026-23558: grant table v2 race in status page mapping (bsc#1262180).\n","status":"published","published":"2026-05-05T08:03:58Z","modified":"2026-05-06T08:00:07.285522Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1743-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- Update to Xen 4.20.3 bug fix release (bsc#1027519) (jsc#PED-8907).\n- CVE-2025-54505: Floating Point Divider State Sampling on AMD CPUs AMD-SN-7053 (bsc#1262428).\n- CVE-2026-23557: Xenstored DoS via XS_RESET_WATCHES command (bsc#1262178).\n- CVE-2026-23558: grant table v2 race in status page mapping (bsc#1262180).\n","status":"published","published":"2026-05-07T07:15:57Z","modified":"2026-05-08T08:15:40.023501Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1998-1","title":"Security update for xen","description":"This update for xen fixes the following issue\n\n- CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264066).\n\n","status":"published","published":"2026-05-19T07:10:39Z","modified":"2026-05-20T08:00:07.282572794Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2066-1","title":"Security update for xen","description":"This update for xen fixes the following issues\n\n- CVE-2025-54505: Floating Point Divider State Sampling on AMD CPUs AMD-SN-7053 (bsc#1262428).\n- CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264066).\n- CVE-2026-23557: Xenstored DoS via XS_RESET_WATCHES command (bsc#1262178).\n- CVE-2026-23558: grant table v2 race in status page mapping (bsc#1262180).\n","status":"published","published":"2026-05-26T07:28:44Z","modified":"2026-05-27T08:15:04.596887591Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2102-1","title":"Security update for xen","description":"This update for xen fixes the following issues\n\n- CVE-2025-54505: Floating Point Divider State Sampling on AMD CPUs AMD-SN-7053 (bsc#1262428).\n- CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264066).\n- CVE-2026-23557: Xenstored DoS via XS_RESET_WATCHES command (bsc#1262178).\n- CVE-2026-23558: grant table v2 race in status page mapping (bsc#1262180).\n","status":"published","published":"2026-05-28T07:14:06Z","modified":"2026-05-29T08:15:05.019775264Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}