x86 HVM I/O port list traversal
Summary
| CVE | CVE-2026-42487 |
|---|---|
| State | PUBLISHED |
| Assigner | XEN |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-18 14:17:25 UTC |
| Updated | 2026-06-22 18:38:02 UTC |
| Description | HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far. |
Risk And Classification
Primary CVSS: v3.1 7.9 HIGH from ADP
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
EPSS: 0.000950000 probability, percentile 0.008450000 (date 2026-06-25)
Problem Types: CWE-362 | CWE-362 CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 7.9 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.9 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| xenbits.xenproject.org/xsa/advisory-491.html | [email protected] | xenbits.xenproject.org | |
| xenbits.xen.org/xsa/advisory-491.html | af854a3a-2127-422b-91ae-364da2661108 | xenbits.xen.org | |
| www.openwall.com/lists/oss-security/2026/06/09/11 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by Jan Beulich of SUSE. (en)
Additional Advisory Data
Workarounds
CNA: Running only PV or PVH guests will avoid the vulnerability. (Switching from a device model stub domain or a de-privileged device model to a fully privileged Dom0 device model does NOT mitigate this vulnerability. Rather, it simply recategorises the vulnerability to hostile management code, regarding it "as designed"; thus it merely reclassifies these issues as "not a bug". The security of a Xen system using stub domains is still better than with a qemu-dm running as a Dom0 process. Users and vendors of stub qemu dm systems should not change their configuration to use a Dom0 qemu process.)