CVE-2026-42487

Description

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.

PUBLISHED Reserved 2026-04-27 | Published 2026-06-18 | Updated 2026-06-18 | Assigner XEN

Product status

Credits

This issue was discovered by Jan Beulich of SUSE. finder

References

xenbits.xen.org/xsa/advisory-491.html

www.openwall.com/lists/oss-security/2026/06/09/11

xenbits.xenproject.org/xsa/advisory-491.html

cve.org (CVE-2026-42487)

nvd.nist.gov (CVE-2026-42487)

Download JSON