VSA-2026-035: DMs may cause mem leak by IRQ binding (CVE-2026-62437 / XSA-509)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-09-08 | 2026-09-08 | 🟠Moderate | Not available yet | - XCP-ng 8.3 |
A memory leak vulnerability when passing through PCI devices in the Xen hypervisor has been discovered. For Vates products, we classify the impact as Moderate. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
Impact​
An HVM guest with one or more PCI devices assigned can cause a memory leak in the hypervisor, possibly leading to Denial of Service (DoS) of the entire host.
Only HVM guests with assigned PCI devices can leverage the vulnerability.
Status​
- 2026-09-08: Released
Affected Versions​
- XCP-ng 8.3: Affected.
Mitigation​
Running only HVM guests without passing through PCI devices to them will also avoid the vulnerability.
Resolution​
As of 2026-09-08, the updated xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
xen-4.17.6-12.3.xcpng8.3
Credits​
This issue was discovered by Jan Beulich of SUSE.