Описание
Security update for xen
This update for xen fixes the following issues
- CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528).
- CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling (bsc#1271530).
- CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531).
- CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532).
- CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534).
- CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535).
- CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536).
- CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537).
- CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538).
- CVE-2026-62434: PoD: Don't try to reclaim special pages (bsc#1271539).
- pygrub is only supported in de-privileged mode (XSA-508) (bsc#1271947).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Micro 5.5
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:3423-1
- E-Mail link for SUSE-SU-2026:3423-1
- SUSE Security Ratings
- SUSE Bug 1271528
- SUSE Bug 1271530
- SUSE Bug 1271531
- SUSE Bug 1271532
- SUSE Bug 1271533
- SUSE Bug 1271534
- SUSE Bug 1271535
- SUSE Bug 1271536
- SUSE Bug 1271537
- SUSE Bug 1271538
- SUSE Bug 1271539
- SUSE Bug 1271947
- SUSE CVE CVE-2026-42493 page
- SUSE CVE CVE-2026-42494 page
- SUSE CVE CVE-2026-42495 page
- SUSE CVE CVE-2026-62423 page
- SUSE CVE CVE-2026-62424 page
Описание
Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.
Затронутые продукты
Ссылки
- CVE-2026-42493
- SUSE Bug 1271528
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-42494
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-42495
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-62423
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-62424
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-62425
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
Затронутые продукты
Ссылки
- CVE-2026-62426
- SUSE Bug 1271531
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
Затронутые продукты
Ссылки
- CVE-2026-62427
- SUSE Bug 1271531
Описание
When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.
Затронутые продукты
Ссылки
- CVE-2026-62428
- SUSE Bug 1271532
Описание
Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.
Затронутые продукты
Ссылки
- CVE-2026-62429
- SUSE Bug 1271534
Описание
Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.
Затронутые продукты
Ссылки
- CVE-2026-62430
- SUSE Bug 1271535
Описание
The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.
Затронутые продукты
Ссылки
- CVE-2026-62431
- SUSE Bug 1271536
Описание
The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
Затронутые продукты
Ссылки
- CVE-2026-62432
- SUSE Bug 1271537
Описание
Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.
Затронутые продукты
Ссылки
- CVE-2026-62433
- SUSE Bug 1271538
Описание
A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.
Затронутые продукты
Ссылки
- CVE-2026-62434
- SUSE Bug 1271539