VSA-2026-032: evtchn race between FIFO expand and reset (CVE-2026-62432 / XSA-505)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-07-28 | 2026-07-28 | 🔴 Important | Not available yet | - XCP-ng 8.3 |
A race condition vulnerability in the Xen hypervisor's event channel implementation has been discovered. For Vates products, we classify the impact as Important, as a malicious guest can crash Xen leading to a denial of service. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
Impact​
A malicious HVM guest (x86 HVM or PVH, and ARM) can crash Xen leading to a denial of service. A malicious x86 PV guest can most likely crash Xen leading to a denial of service, but memory corruption or privilege escalation cannot be ruled out.
Affected Versions​
- XCP-ng 8.3: Affected.
Mitigation​
There are no known mitigations.
Resolution​
As of 2026-07-28, the updated xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
4.17.6-9.3.1.xcpng8.3