CVE-2026-62437 (GCVE-0-2026-62437)
Vulnerability from cvelistv5
Published
2026-09-08 12:10
Modified
2026-09-10 18:13
Severity ?
6.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Summary
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
References
Impacted products
Vendor Product Version
Xen Xen Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-08T17:08:26.757Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-509.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62437",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T18:11:30.445915Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T18:13:23.073Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-509"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from at least 3.2 onwards are affected.  Older versions\nhave not been inspected.\n\nOnly HVM guests with assigned PCI devices can leverage the vulnerability."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Jan Beulich of SUSE."
        }
      ],
      "datePublic": "2026-09-08T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A HVM guest with one or more PCI devices assigned can cause a memory leak\nin the hypervisor, possibly leading to Denial of Service (DoS) of the\nentire host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T12:10:52.643Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-509.html"
        }
      ],
      "title": "x86: DMs may cause mem leak by IRQ binding",
      "workarounds": [
        {
          "lang": "en",
          "value": "Running only PV or PVH guests will avoid the vulnerability.\n\nRunning only HVM guests without passing through PCI devices to them will\nalso avoid the vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62437",
    "datePublished": "2026-09-08T12:10:52.643Z",
    "dateReserved": "2026-07-14T10:28:12.655Z",
    "dateUpdated": "2026-09-10T18:13:23.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://xenbits.xen.org/xsa/advisory-509.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/09/08/6\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-09-08T17:08:26.757Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-62437\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-10T18:11:30.445915Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-10T18:13:03.684Z\"}}], \"cna\": {\"title\": \"x86: DMs may cause mem leak by IRQ binding\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Jan Beulich of SUSE.\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"A HVM guest with one or more PCI devices assigned can cause a memory leak\\nin the hypervisor, possibly leading to Denial of Service (DoS) of the\\nentire host.\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-509\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2026-09-08T12:00:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-509.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Running only PV or PVH guests will avoid the vulnerability.\\n\\nRunning only HVM guests without passing through PCI devices to them will\\nalso avoid the vulnerability.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"When guests are terminated, various pieces of cleanup need carrying out.\\nThe cleaning up of PCI devices which were assigned to guests, and the\\nassociated removal of tracking structures for IRQs used by the devices\\noccurs relatively early in the process.  Unfortunately after that point\\nthe guest about to be terminated could cause its device model (DM) to\\nre-establish such tracking structures, by having it bind one or more IRQs\\nanew.  While some of those tracking structures would still be cleaned up\\nlater on, at least one would not be.\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"All Xen versions from at least 3.2 onwards are affected.  Older versions\\nhave not been inspected.\\n\\nOnly HVM guests with assigned PCI devices can leverage the vulnerability.\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2026-09-08T12:10:52.643Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-62437\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-10T18:13:23.073Z\", \"dateReserved\": \"2026-07-14T10:28:12.655Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2026-09-08T12:10:52.643Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.