Описание
Security update for xen
This update for xen fixes the following issues:
Update to version 4.20.3 (jsc#PED-8907).
Security issues fixed:
- CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528).
- CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling (bsc#1271530).
- CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531).
- CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532).
- CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534).
- CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535).
- CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536).
- CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537).
- CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538).
- CVE-2026-62434: PoD: Don't try to reclaim special pages (bsc#1271539).
- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).
- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).
- pygrub is only supported in de-privileged mode (bsc#1271947).
Non security issue fixed:
- Xen: Missing upstream bug fixes (bsc#1027519).
Список пакетов
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Module for Server Applications 15 SP7
Ссылки
- Link for SUSE-SU-2026:4090-1
- E-Mail link for SUSE-SU-2026:4090-1
- SUSE Security Ratings
- SUSE Bug 1027519
- SUSE Bug 1271528
- SUSE Bug 1271530
- SUSE Bug 1271531
- SUSE Bug 1271532
- SUSE Bug 1271533
- SUSE Bug 1271534
- SUSE Bug 1271535
- SUSE Bug 1271536
- SUSE Bug 1271537
- SUSE Bug 1271538
- SUSE Bug 1271539
- SUSE Bug 1271947
- SUSE Bug 1276838
- SUSE Bug 1276839
- SUSE Bug 1276841
- SUSE CVE CVE-2026-42493 page
Описание
Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.
Затронутые продукты
Ссылки
- CVE-2026-42493
- SUSE Bug 1271528
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-42494
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-42495
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-62423
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-62424
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
Затронутые продукты
Ссылки
- CVE-2026-62425
- SUSE Bug 1271530
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
Затронутые продукты
Ссылки
- CVE-2026-62426
- SUSE Bug 1271531
Описание
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
Затронутые продукты
Ссылки
- CVE-2026-62427
- SUSE Bug 1271531
Описание
When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.
Затронутые продукты
Ссылки
- CVE-2026-62428
- SUSE Bug 1271532
Описание
Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.
Затронутые продукты
Ссылки
- CVE-2026-62429
- SUSE Bug 1271534
Описание
Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.
Затронутые продукты
Ссылки
- CVE-2026-62430
- SUSE Bug 1271535
Описание
The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.
Затронутые продукты
Ссылки
- CVE-2026-62431
- SUSE Bug 1271536
Описание
The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
Затронутые продукты
Ссылки
- CVE-2026-62432
- SUSE Bug 1271537
Описание
Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.
Затронутые продукты
Ссылки
- CVE-2026-62433
- SUSE Bug 1271538
Описание
A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.
Затронутые продукты
Ссылки
- CVE-2026-62434
- SUSE Bug 1271539
Описание
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
Затронутые продукты
Ссылки
- CVE-2026-62437
- SUSE Bug 1276838
Описание
A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
Затронутые продукты
Ссылки
- CVE-2026-79602
- SUSE Bug 1276839
Описание
x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.
Затронутые продукты
Ссылки
- CVE-2026-79603
- SUSE Bug 1276841