PT-2026-48244 · Xen+4 · Xen

Andrew Cooper · CVE-2026-42490 · Published 2026-06-09 · Updated 2026-06-29

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489.

Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2026-42490

SUSE-SU-2026:2328-1

SUSE-SU-2026:2329-1

SUSE-SU-2026:2364-1

SUSE-SU-2026:2613-1

SUSE-SU-2026:2668-1

Affected Products

Xen

References · 32

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42490 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2328-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42490 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:2613-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2329-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2668-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42490 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42490 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42490 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2364-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-42490 · Vendor Advisory
• https://suse.com/support/update/announcement/2026/suse-su-20262364-1 · Note
• https://xenbits.xen.org/xsa/advisory-492.html · Note
• https://bugzilla.suse.com/1266955 · Note