{"id":"CVE-2026-42490","aliases":["ALPINE-CVE-2026-42490","DEBIAN-CVE-2026-42490","EUVD-2026-37890","GHSA-9xq7-8p44-p7p4","SUSE-SU-2026:2328-1","SUSE-SU-2026:2329-1","SUSE-SU-2026:2364-1","SUSE-SU-2026:2613-1","SUSE-SU-2026:2668-1","UBUNTU-CVE-2026-42490"],"status":"published","title":"domctl lock open to abuse","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo create and manage guests, domctl operations are used by the control\ndomain, a possible Xenstore domain, or by a domain controlling a\nparticular guest.  Some of these operations may not be executed in\nparallel, so a system-wide lock is used.  The way that lock is acquired\nis, however, not providing any fairness.  This is CVE-2026-42489.\n\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.  This is\nCVE-2026-42490.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.002,"percentile":0.09913,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-667"],"published":"2026-06-10T07:39:28Z","modified":"2026-10-17T13:00:05Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.18.5-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.19.5-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.20.3-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.20.3-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.21.1-r6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.17.7-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.20.3+127-gc42374a105-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.20.3+127-gc42374a105-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.5-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.5-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.1-r6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7-0+deb12u1"}]}],"versions":["4.17.1+2-gb773c48e36-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1~deb12u1","4.17.2-1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1","4.17.3+10-g091466ba55-1.1~exp1","4.17.3+10-g091466ba55-1.1~exp2","4.17.3+10-g091466ba55-1~deb12u1","4.17.3+36-g54dacb5c02-1","4.17.5+23-ga4e5191dc0-1","4.17.5+23-ga4e5191dc0-1+deb12u1","4.17.5+72-g01140da4e8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3+127-gc42374a105-0+deb13u1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-0+deb13u1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-0+deb13u1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2"]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3+127-gc42374a105-1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.6_12-150500.3.73.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.6_12-150500.3.73.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.6_12-150500.3.73.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.6_12-150500.3.73.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.6_12-150500.3.73.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.5_18-150600.3.50.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.5_18-150600.3.50.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3_06-150700.3.41.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3_06-150700.3.41.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_10-150400.4.86.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_10-150400.4.86.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_10-150400.4.86.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_10-150400.4.86.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_10-150400.4.86.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_10-150400.4.86.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_70-3.145.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_70-3.145.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2","4.11.3+24-g14b62ab3e5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4+24-gddaaccbbab-1ubuntu2","4.16.0-1~ubuntu2","4.16.0-1~ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.2-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1ubuntu1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1ubuntu2","4.17.3+10-g091466ba55-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0-1ubuntu1","4.20.0+68-g35cb38b222-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.2+7-g1badcf5035-2build2","4.20.2+37-g61ff35323e-1ubuntu1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-2","4.20.2+7-g1badcf5035-2build2"]}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-492.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42490"},{"url":"https://github.com/advisories/GHSA-9xq7-8p44-p7p4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42490","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42490","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262328-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266952","tags":["report"]},{"url":"https://bugzilla.suse.com/1266953","tags":["report"]},{"url":"https://bugzilla.suse.com/1266955","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42490","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262329-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262364-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262613-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264066","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54518","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262668-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-42490","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42490","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-492.html","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42490","title":"domctl lock open to abuse","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo create and manage guests, domctl operations are used by the control\ndomain, a possible Xenstore domain, or by a domain controlling a\nparticular guest.  Some of these operations may not be executed in\nparallel, so a system-wide lock is used.  The way that lock is acquired\nis, however, not providing any fairness.  This is CVE-2026-42489.\n\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.  This is\nCVE-2026-42490.","status":"published","published":"2026-06-18T13:47:13.257Z","modified":"2026-06-18T15:04:50.692Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-667"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-37890","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo create and manage guests, domctl operations are used by the control\ndomain, a possible Xenstore domain, or by a domain controlling a\nparticular guest.  Some of these operations may not be executed in\nparallel, so a system-wide lock is used.  The way that lock is acquired\nis, however, not providing any fairness.  This is CVE-2026-42489.\n\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.  This is\nCVE-2026-42490.","status":"published","published":"2026-06-18T13:47:13Z","modified":"2026-06-18T15:04:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:36.672794Z"}],"ghsa":[{"id":"GHSA-9xq7-8p44-p7p4","title":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects...","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo create and manage guests, domctl operations are used by the control\ndomain, a possible Xenstore domain, or by a domain controlling a\nparticular guest.  Some of these operations may not be executed in\nparallel, so a system-wide lock is used.  The way that lock is acquired\nis, however, not providing any fairness.  This is CVE-2026-42489.\n\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.  This is\nCVE-2026-42490.","status":"published","published":"2026-06-18T15:32:02Z","modified":"2026-06-18T18:35:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-667"],"updated_at":"2026-11-02T15:08:53.737891Z"}],"nvd":[{"id":"CVE-2026-42490","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo create and manage guests, domctl operations are used by the control\ndomain, a possible Xenstore domain, or by a domain controlling a\nparticular guest.  Some of these operations may not be executed in\nparallel, so a system-wide lock is used.  The way that lock is acquired\nis, however, not providing any fairness.  This is CVE-2026-42489.\n\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.  This is\nCVE-2026-42490.","status":"published","published":"2026-06-18T14:17:25.6Z","modified":"2026-06-22T18:38:02.507Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-667"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"ALPINE-CVE-2026-42490","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo create and manage guests, domctl operations are used by the control\ndomain, a possible Xenstore domain, or by a domain controlling a\nparticular guest.  Some of these operations may not be executed in\nparallel, so a system-wide lock is used.  The way that lock is acquired\nis, however, not providing any fairness.  This is CVE-2026-42489.\n\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.  This is\nCVE-2026-42490.","status":"published","published":"2026-06-18T14:17:25.6Z","modified":"2026-10-01T02:17:49.293221816Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"DEBIAN-CVE-2026-42490","description":"[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]  To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest.  Some of these operations may not be executed in parallel, so a system-wide lock is used.  The way that lock is acquired is, however, not providing any fairness.  This is CVE-2026-42489.  Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking.  This is CVE-2026-42490.","status":"published","published":"2026-06-18T14:17:25.6Z","modified":"2026-10-04T22:00:07.974037909Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"UBUNTU-CVE-2026-42490","description":"[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest.  Some of these operations may not be executed in parallel, so a system-wide lock is used.  The way that lock is acquired is, however, not providing any fairness.  This is CVE-2026-42489. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking.  This is CVE-2026-42490.","status":"published","published":"2026-06-18T14:17:00Z","modified":"2026-10-17T13:00:05.161580769Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"SUSE-SU-2026:2328-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2026-42487: x86 HVM I/O port list traversal (bsc#1266952).\n- CVE-2026-42488: x86: mismatched mapcache metadata (bsc#1266955).\n- CVE-2026-42489,CVE-2026-42490: domctl lock open to abuse (bsc#1266953).\n","status":"published","published":"2026-06-10T07:39:28Z","modified":"2026-06-10T16:15:23.593514969Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:2329-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2026-42487: x86 HVM I/O port list traversal (bsc#1266952).\n- CVE-2026-42488: x86: mismatched mapcache metadata (bsc#1266955).\n- CVE-2026-42489,CVE-2026-42490: domctl lock open to abuse (bsc#1266953).\n","status":"published","published":"2026-06-10T07:39:36Z","modified":"2026-06-10T16:15:23.545420397Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:2364-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2026-42487: x86 HVM I/O port list traversal (bsc#1266952).\n- CVE-2026-42488: x86: mismatched mapcache metadata (bsc#1266955).\n- CVE-2026-42489,CVE-2026-42490: domctl lock open to abuse (bsc#1266953).\n","status":"published","published":"2026-06-11T06:54:28Z","modified":"2026-06-12T08:45:05.902800484Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:2613-1","title":"Security update for xen","description":"This update for xen fixes the following issues\n\n- CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264066).\n- CVE-2026-42487: x86 HVM I/O port list traversal (bsc#1266952).\n- CVE-2026-42488: x86: mismatched mapcache metadata (bsc#1266955).\n- CVE-2026-42489,CVE-2026-42490: domctl lock open to abuse (bsc#1266953).\n","status":"published","published":"2026-06-24T09:01:44Z","modified":"2026-06-25T06:15:06.847645846Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2668-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2026-42487: xen: x86 HVM I/O port list traversal (XSA-491) (bsc#1266952).\n- CVE-2026-42488: xen: x86: mismatched mapcache metadata (XSA-494) (bsc#1266955).\n- CVE-2026-42489,CVE-2026-42490: xen: domctl lock open to abuse (XSA-492) (bsc#1266953).\n","status":"published","published":"2026-06-29T05:42:01Z","modified":"2026-06-30T09:15:10.733091664Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}