CVE-2026-42490 Details

A vulnerability exists in the Xen Project's domctl operations, which are used to create and manage guest domains. The issue arises because the system-wide lock used to manage these operations lacks fairness, allowing less privileged entities to potentially stall more privileged ones. This could lead to a denial-of-service condition affecting the entire host. Additionally, when XSM/Flask is enabled, the lock acquisition for some operations occurs before permission checks are performed, further exacerbating the issue.

Users can apply the patches available in the Xen Security Advisory XSA-492 to address this vulnerability. Note that the patches for released versions are prepared to apply to the stable branches and may not apply cleanly to the most recent release tarball. Downstream users are encouraged to update to the tip of the stable branch before applying these patches.