CVE-2026-62426 Details
Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
A vulnerability in Xen's sysctl locking mechanism can lead to a denial-of-service condition. All Xen versions from 4.0 onwards are affected. The issue arises because the locks used to manage sysctl operations are not acquired in a fair manner, allowing less privileged entities to potentially stall operations of equally or more privileged entities. This can disrupt system processes and, in some cases, affect the entire host.
Applying the appropriate patches available in the Xen Security Advisory XSA-499 resolves this issue. Note that the patches include an adjustment to the default Flask policy, which may need to be replicated if custom policies are in use.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://xenbits.xenproject.org/xsa/advisory-499.html | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-412 | Unrestricted Externally Accessible Lock | CISA-ADP |
| CWE-667 | Improper Locking | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Xen | >= 4.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |