{"id":"CVE-2026-62437","aliases":["ALPINE-CVE-2026-62437","DEBIAN-CVE-2026-62437","EUVD-2026-72719","GHSA-vfxv-3qcw-g966","SUSE-SU-2026:4087-1","SUSE-SU-2026:4088-1","SUSE-SU-2026:4089-1","SUSE-SU-2026:4090-1","SUSE-SU-2026:5140-1","UBUNTU-CVE-2026-62437","openSUSE-SU-2026:11738-1"],"status":"published","title":"x86: DMs may cause mem leak by IRQ binding","description":"When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00095,"percentile":0.00612,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2026-09-08T12:00:00Z","modified":"2026-11-10T13:15:07Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.19.6-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.20.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.20.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.21.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.17.7+13-g2445b30a44-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.20.4+39-gf1e1321c87-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.20.4+39-gf1e1321c87-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.6-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.2-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7+13-g2445b30a44-0+deb12u1"}]}],"versions":["4.17.1+2-gb773c48e36-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1~deb12u1","4.17.2-1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1","4.17.3+10-g091466ba55-1.1~exp1","4.17.3+10-g091466ba55-1.1~exp2","4.17.3+10-g091466ba55-1~deb12u1","4.17.3+36-g54dacb5c02-1","4.17.5+23-ga4e5191dc0-1","4.17.5+23-ga4e5191dc0-1+deb12u1","4.17.5+72-g01140da4e8-1","4.17.7-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4+39-gf1e1321c87-0+deb13u1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-0+deb13u1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-0+deb13u1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2","4.20.3+127-gc42374a105-0+deb13u1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4+39-gf1e1321c87-1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.6_16-150500.3.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_14-150400.4.92.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.7_14-150400.4.92.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_74-3.151.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4_04-150700.3.46.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4_04-150700.3.46.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.6_03-150600.3.56.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.6_03-150600.3.56.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2","4.11.3+24-g14b62ab3e5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4+24-gddaaccbbab-1ubuntu2","4.16.0-1~ubuntu2","4.16.0-1~ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.2-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1ubuntu1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1ubuntu2","4.17.3+10-g091466ba55-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.2+7-g1badcf5035-2build2","4.20.2+37-g61ff35323e-1ubuntu1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-2","4.20.2+7-g1badcf5035-2build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.0_04-1.1"}]}],"bundled":3}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-509.html"},{"url":"http://xenbits.xen.org/xsa/advisory-509.html"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/08/6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62437"},{"url":"https://github.com/advisories/GHSA-vfxv-3qcw-g966"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-62437","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-62437","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264087-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276838","tags":["report"]},{"url":"https://bugzilla.suse.com/1276839","tags":["report"]},{"url":"https://bugzilla.suse.com/1276841","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79603","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264088-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264089-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264090-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1271528","tags":["report"]},{"url":"https://bugzilla.suse.com/1271530","tags":["report"]},{"url":"https://bugzilla.suse.com/1271531","tags":["report"]},{"url":"https://bugzilla.suse.com/1271532","tags":["report"]},{"url":"https://bugzilla.suse.com/1271533","tags":["report"]},{"url":"https://bugzilla.suse.com/1271534","tags":["report"]},{"url":"https://bugzilla.suse.com/1271535","tags":["report"]},{"url":"https://bugzilla.suse.com/1271536","tags":["report"]},{"url":"https://bugzilla.suse.com/1271537","tags":["report"]},{"url":"https://bugzilla.suse.com/1271538","tags":["report"]},{"url":"https://bugzilla.suse.com/1271539","tags":["report"]},{"url":"https://bugzilla.suse.com/1271947","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62434","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283321","tags":["report"]},{"url":"https://bugzilla.suse.com/1283322","tags":["report"]},{"url":"https://bugzilla.suse.com/1283323","tags":["report"]},{"url":"https://bugzilla.suse.com/1283325","tags":["report"]},{"url":"https://bugzilla.suse.com/1288663","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79611","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-62437","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62437","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-62437","title":"x86: DMs may cause mem leak by IRQ binding","description":"When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be.","status":"published","published":"2026-09-08T12:10:52.643Z","modified":"2026-09-10T18:13:23.073Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:20:14.999906Z"}],"euvd":[{"id":"EUVD-2026-72719","description":"When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be.","status":"published","published":"2026-09-08T12:10:52Z","modified":"2026-09-10T18:13:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:28:23.831795Z"}],"ghsa":[{"id":"GHSA-vfxv-3qcw-g966","title":"When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI...","description":"When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be.","status":"published","published":"2026-09-08T15:31:53Z","modified":"2026-09-10T21:32:21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:11:43.240477Z"}],"nvd":[{"id":"CVE-2026-62437","description":"When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be.","status":"published","published":"2026-09-08T13:17:19.623Z","modified":"2026-09-10T19:17:31.64Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:12:44.436435Z"}],"osv":[{"id":"ALPINE-CVE-2026-62437","description":"When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be.","status":"published","published":"2026-09-08T13:17:19.623Z","modified":"2026-10-01T02:17:49.381203583Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"DEBIAN-CVE-2026-62437","description":"When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process.  Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew.  While some of those tracking structures would still be cleaned up later on, at least one would not be.","status":"published","published":"2026-09-08T13:17:19.623Z","modified":"2026-11-04T23:02:29.596937863Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-04T23:09:59.08306Z"},{"id":"UBUNTU-CVE-2026-62437","description":"When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process.  Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew.  While some of those tracking structures would still be cleaned up later on, at least one would not be.","status":"published","published":"2026-09-08T12:00:00Z","modified":"2026-10-17T13:00:30.754680971Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"openSUSE-SU-2026:11738-1","title":"xen-4.22.0_04-1.1 on GA media","description":"These are all security issues fixed in the xen-4.22.0_04-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:23:46.113454173Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2026:4087-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).\n- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).\n- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).\n","status":"published","published":"2026-09-08T12:26:17Z","modified":"2026-09-13T18:23:21.244046726Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4088-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).\n- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).\n- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).\n","status":"published","published":"2026-09-08T12:26:32Z","modified":"2026-09-13T18:23:20.566447327Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4089-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).\n- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).\n","status":"published","published":"2026-09-08T12:26:42Z","modified":"2026-09-13T18:23:20.558911444Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4090-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nUpdate to version 4.20.3 (jsc#PED-8907).\n\nSecurity issues fixed:\n\n- CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528).\n- CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660\n  handling (bsc#1271530).\n- CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531).\n- CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532).\n- CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534).\n- CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535).\n- CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536).\n- CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537).\n- CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538).\n- CVE-2026-62434: PoD: Don't try to reclaim special pages (bsc#1271539).\n- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).\n- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).\n- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).\n- pygrub is only supported in de-privileged mode (bsc#1271947).\n\nNon security issue fixed:\n\n- Xen: Missing upstream bug fixes (bsc#1027519).\n","status":"published","published":"2026-09-08T12:26:56Z","modified":"2026-09-13T18:23:20.566887008Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:5140-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).\n- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).\n- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).\n- CVE-2026-79609: x86: XPTI may break on huge-memory systems (bsc#1283321).\n- CVE-2026-79610: grant-table: double version change race (bsc#1283322).\n- CVE-2026-79611: VMX: VMentry failure with branch tracing and blocked states (bsc#1283323).\n- CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak (bsc#1283325).\n- CVE-2026-102703,CVE-2026-102704: arbitrary read/write via grant copy (bsc#1288663).\n\nNon security issue fixed:\n\n- Update to Xen 4.18.6 security bug fix release (bsc#1027519).\n","status":"published","published":"2026-11-09T13:24:47Z","modified":"2026-11-10T13:15:07.782924083Z","updated_at":"2026-11-10T13:29:51.103746Z"}]}}