Xen XSA-499 Advisory: CVE-2026-62426/427 Lock Fairness and Permission Check Timing Flaws Leading to DoS

Vulnerability Overview Vulnerability ID: CVE-2026-62426, CVE-2026-62427 Title: Abuse of sysctl and platform locks Description: In the Xen system, sysctl and platform operations are used to control the control domain or a potential Xenstore domain. Certain operations must not be executed in parallel and therefore rely on system-level locks. However, the acquisition of these locks lacks fairness, and when XSM/FW is in use, lock acquisition occurs before permission checks. This can lead to a Denial of Service (DoS) caused by a low-privilege entity leveraging a high-privilege entity. Scope of Impact Affected Systems: This vulnerability affects all Xen versions from 4.0 onwards. Earlier versions use different locking mechanisms but may also be susceptible. Remediation Patches: Multiple patch files are provided for different versions of Xen (from 4.17 to 4.21). Deployment Advice: Patches have been released for the stable branches; downstream distributions should update to the stable branch as soon as possible. Note: The patches include adjustments to the default Flask policy. If core policies are in use, corresponding changes must be made there. Code Block ```plaintext -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-62426,CVE-2026-62427 / XSA-499 version 2 sysctl and platform-ops locks open to abuse UPDATES IN VERSION 2 Add further tags to patches. Public release. ISSUE DESCRIPTION To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/FW in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-ops issue is CVE-2026-62427. IMPACT A less privileged entity may stall an equally or more privileged entity, potentially leading to a Denial of Service (DoS) of up to the entire host. VULNERABLE SYSTEMS All Xen versions from 4.0 onwards are vulnerable. Earlier versions use a different locking operation, but may also be vulnerable. MITIGATION There is no known mitigation. CREDITS This issue was discovered by Jan Beulich of SUSE. RESOLUTION Applying the appropriate set of attached patches resolves this issue. NOTE: The patches include an adjustment to the default Flask policy. When core policies are in use, a respective change will need making there. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsax99/xsax99-7.patch xen-unstable - Xen 4.21.x xsax99/xsax99-4.20-7.patch Xen 4.20.x - Xen 4.19.x xsax99/xsax99-4.18-7.patch Xen 4.18.x xsax99/xsax99-4.17-7.patch Xen 4.17.x $ sha256sum xsax99/* 16716146d7106b970717bc4801a5491116d0ff6e7fd428996bfb9fd1d747 xsax99/xsax99-1.patch 80692a9a361a407a7e7c9c104a453847295471fd13d0713c049b7fe xsax99/xsax99-2.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-3.17-1.patch 3f8346602a3e4ec6cf40a800284464243441df4f14b6b5777f3420f816 xsax99/xsax99-4.17-2.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.17-3.patch 3f8346602a3e4ec6cf40a800284464243441df4f14b6b5777f3420f816 xsax99/xsax99-4.17-4.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.17-5.patch 3f8346602a3e4ec6cf40a800284464243441df4f14b6b5777f3420f816 xsax99/xsax99-4.17-6.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.17-7.patch d516d678a756f08a48d42a1c4a8b621be4ca108410848e8d8c107f8b33f2 xsax99/xsax99-4.18-1.patch 77287c6a6df768b0a2b041a448b81503100b6c4d333754c27 xsax99/xsax99-4.18-2.patch 8c288089991460df1fc1d265e08837935ab8d5696154699a3b4966c4e xsax99/xsax99-4.18-3.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.18-4.patch 9551c14ec178b951e07f3b6f86e73ac4d0d566d45d43a31d092b3b7 xsax99/xsax99-4.18-5.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.18-6.patch 48d896655368199b6ab6199b1209ae78ec2d415735a57106cf7e7785 xsax99/xsax99-4.18-7.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.20-1.patch 9423118414645017121b28775f73c495646b6454f6678b8b57e78c19b8b xsax99/xsax99-4.20-2.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.20-3.patch 892a1488b1400b048b12d4a9562056a5d52547f40418b84b4c61c65be xsax99/xsax99-4.20-4.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.20-5.patch 66646313292d477ca00214d427b5a2cf18b5c602f427140010928ac xsax99/xsax99-4.20-6.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.20-7.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-5.patch d91737487c45b931609256de3d27c8e8f

Goal Reached Thanks to every supporter — we hit 100%!

Xen XSA-499 Advisory: CVE-2026-62426/427 Lock Fairness and Permission Check Timing Flaws Leading to DoS