CVE-2026-62428 Details
Description
When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.
A type confusion vulnerability has been identified in Xen's grant-copy operations, present in all versions from 4.2 onwards. When a grant-copy operation is initiated, the corresponding grant may already be in use by another operation, such as a mapping or another copy. This can lead to inconsistencies during permission checks and the actual copy operation, particularly when the grant is 'pinned' by an active operation. As a result, the permission check might be performed on a different page than the one involved in the copy, creating a potential exploitation vector.
To address this vulnerability, apply the appropriate patch available for the specific Xen version in use. Patches for released versions are generally prepared to apply to the stable branches. For Xen versions 4.13 and newer, which can be built without grant table support, this vulnerability does not apply.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/28/16 | CVE | |
| http://xenbits.xen.org/xsa/advisory-500.html | CVE | |
| https://xenbits.xenproject.org/xsa/advisory-500.html | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Xen | >= 4.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CVE |
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | CVE Modified | CVE |
| Jul 28, 2026 | New CVE Received | [email protected] |