VSA-2026-026: sysctl and platform-op locks open to abuse (CVE-2026-62426, CVE-2026-62427 / XSA-499)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-07-28 | 2026-07-28 | 🟢 Low | Not available yet | - XCP-ng 8.3 |
A locking fairness vulnerability in the Xen hypervisor's sysctl and platform-op operations has been discovered. For Vates products, we classify the impact as Low, as a less privileged entity may stall an equally or more privileged entity, potentially leading to a Denial of Service. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking.
The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
Impact​
A less privileged entity may stall an equally or more privileged entity, potentially leading to a Denial of Service (DoS) of up to the entire host.
Affected Versions​
- XCP-ng 8.3: Affected, but not exploitable, in XCP-ng no unprivileged entity can leverage directly this vulnerability. XCP-ng also relies on XSM/Silo rather than XSM/Flask.
Mitigation​
There is no known mitigation.
Resolution​
As of 2026-07-28, fix for this low severity vulnerability is not yet integrated in XCP-ng 8.3 packages.
Credits​
This issue was discovered by Jan Beulich of SUSE.