PT-2026-65472 · Xen · Xen

CVE-2026-62430 · Published 2026-07-28 · Updated 2026-07-28

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-62430

Affected Products

Xen

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-62430 · Security Note
• https://xenbits.xenproject.org/xsa/advisory-503.html · Note
• http://xenbits.xen.org/xsa/advisory-503.html · Note