Xen XS-A92 Advisory: Denial of Service Vulnerability and Patch Fix

Xen Security Advisory XS-A92 Vulnerability Overview CVE ID: CVE-2026-42489 Release Date: 2026-06-09 Update Date: 26-09-12 Version: 3 Title: Prevention of lock abuse Impact Scope Affected Systems: All Xen versions starting from 3.3, including earlier versions that use different locking operations, which may also be affected. Remediation Patch Files: Multiple patch files are provided for different versions of Xen, such as through . Applying Patches: It is recommended to apply the appropriate patch set, including patches 0 and 41, to adjust the default Flask policy. Additional adjustments may be necessary when using custom policies. Branch Updates: The patches are ready to be applied to the stable branch, but should not be applied to the latest public release branch. Downstream distributors are encouraged to update to the tip of the stable branch before applying the patches. Patch Application Example Additional Information Problem Description: In order to create and manage virtual machines, operations in the control domain may be executed in parallel without the use of system-level locks, leading to unfairness. Impact: Low-privilege entities may trap high-privilege entities, resulting in a denial of service. Mitigations: No known mitigations. Credit: Discovered by Andrew Cooper from Citrix. Resolution: Apply the appropriate patch set, including patches 0 and 41, to adjust the default Flask policy. Embargo During Deployment Deployment Restrictions: During the embargo period, deployment of patches and mitigations is allowed only unless you are a member of the pre-release list. Pre-release List: Members of the pre-release list may deploy significantly different patches or mitigations; contact the Xen Project security team for details. Embargo Lift: After the embargo is lifted, Xen Project notices will remain, but they will no longer apply. The purpose is for the Xen Project security team to oversee. More Information Licensed Deployment: For more information on licensed deployment, please refer to the Xen Project community's security policy agreement: http://www.xenproject.org/security-policy.html Signature Signature: Signed by the Xen Project security team.

Goal Reached Thanks to every supporter — we hit 100%!

Xen XS-A92 Advisory: Denial of Service Vulnerability and Patch Fix