CVE-2026-62427 Details
Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
A vulnerability exists in Xen's management of platform operations locks, which are used by the control domain or a possible Xenstore domain. These locks, intended to prevent certain operations from executing in parallel, are acquired in a manner that lacks fairness. As a result, a less privileged entity could potentially stall a more privileged one, leading to a denial-of-service condition that could affect the entire host. This vulnerability is present in all Xen versions from 4.0 onwards, with earlier versions possibly also vulnerable.
Applying the patches available in the Xen Security Advisory XSA-499 resolves this issue. Note that the patches include an adjustment to the default Flask policy, which will need to be replicated if custom policies are in use.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://xenbits.xenproject.org/xsa/advisory-499.html | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
| CWE-305 | Authentication Bypass by Primary Weakness | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Xen | >= 4.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |