VSA-2026-029: vNUMA domain cleanup may race other operations (CVE-2026-62429 / XSA-502)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-07-28 | 2026-07-28 | 🟢 Low | Not available yet | - XCP-ng 8.3 |
A race condition vulnerability in the Xen hypervisor's vNUMA domain cleanup has been discovered. For Vates products, we classify the impact as Low: while Denial of Service and information leaks are the prevailing effect, the issue is limited to entities controlling guests with vNUMA enabled. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.
Impact​
While Denial of Service (DoS) affecting the entire host and information leaks are the prevailing effect, a device model stub domain or a de-privileged device model running in the control domain may also be able to elevate its privileges to that of the host.
Affected Versions​
- XCP-ng 8.3: Affected, but XCP-ng does not use stub domains.
Mitigation​
On x86, running only PV or PVH guests will avoid the vulnerability. Not enabling vNUMA for HVM guests will also avoid the vulnerability.
Resolution​
As of 2026-07-28, the fix for this low severity vulnerability is not yet integrated in XCP-ng 8.3 packages.
Credits​
This issue was discovered by Teddy Astie of Vates.