vIRQ event channel binding may break Xenstore

Xenstore, to have an up-to-date picture of the entire system, wants to

know of domains appearing and disappearing. To make this more robust, a

new XEN_DOMCTL_get_domain_state was introduced. The management of the

bitmap underlying that operation is tied into the binding of the

VIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear

down the bitmap even in cases when it wasn't set up. Unprivileged domains

can trigger that error path.

Affected products

Xen

Xen

consult Xen advisory XSA-496 - UNKNOWN

References

xenbits.xenproject.org

https://xenbits.xenproject.org/xsa/advisory-496.html

GitHub Security Advisories

GHSA-2hv5-3qjg-gjqr

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing...

https://github.com/advisories/GHSA-2hv5-3qjg-gjqr

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_state was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear down the bitmap even in cases when it wasn't set up. Unprivileged domains can trigger that error path.

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-42492

xenbits.xenproject.org

https://xenbits.xenproject.org/xsa/advisory-496.html

xenbits.xen.org

http://xenbits.xen.org/xsa/advisory-496.html

openwall.com

http://www.openwall.com/lists/oss-security/2026/07/28/13

github.com

https://github.com/advisories/GHSA-2hv5-3qjg-gjqr

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-42492

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-42492",
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "dateUpdated": "2026-07-28T13:34:07.971Z",
    "dateReserved": "2026-04-27T14:20:24.139Z",
    "datePublished": "2026-07-28T12:31:28.304Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN",
        "dateUpdated": "2026-07-28T12:31:28.304Z"
      },
      "datePublic": "2026-07-28T12:00:00.000Z",
      "title": "vIRQ event channel binding may break Xenstore",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xenstore, to have an up-to-date picture of the entire system, wants to\nknow of domains appearing and disappearing.  To make this more robust, a\nnew XEN_DOMCTL_get_domain_state was introduced.  The management of the\nbitmap underlying that operation is tied into the binding of the\nVIRQ_DOM_EXC virtual IRQ.  Unfortunately an error path there would tear\ndown the bitmap even in cases when it wasn't set up.  Unprivileged domains\ncan trigger that error path."
        }
      ],
      "affected": [
        {
          "vendor": "Xen",
          "product": "Xen",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "consult Xen advisory XSA-496",
              "status": "unknown"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-496.html"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unprivileged domain can affect the operation of Xenstore, potentially\nleading to a Denial of Service (DoS) affecting the entire host.  A\nhypervisor crash with similar host wide effect also is possible, albeit\nunlikely."
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen 4.21 and onwards are vulnerable.  Xen 4.20 and older are not\nvulnerable."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no known mitigation."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Grygorii Strashko of EPAM.",
          "type": "finder"
        }
      ]
    },
    "adp": [
      {
        "providerMetadata": {
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE",
          "dateUpdated": "2026-07-28T13:34:07.971Z"
        },
        "title": "CVE Program Container",
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-496.html"
          }
        ]
      }
    ]
  }
}