Xen XSA-503: Out-of-bounds read in vRTC emulation (CVE-2026-62430)

Vulnerability Overview CVE ID: CVE-2026-62430 XSA ID: XSA-503 Title: x86: Out-of-bounds read in vRTC emulation Publication Date: 2026-07-28 12:00 Updated: 2026-07-28 12:05 Version: 2 Issue Description Accesses to the CMOS memory contents are performed using an indirect I/O port pair. Therefore, Xen needs to cache the index chosen by the guest, and one usage of this index did not acquire the necessary lock to prevent concurrent modifications. As a result, a guest could modify the index after it had been checked, leading to a subsequent out-of-bounds read access to array contents. Impact An attacker can read out-of-bounds data, but this is limited to Xen data and does not include data belonging to other guests. Affected Systems All Xen versions from 3.2 onwards are vulnerable. Xen versions 3.1 and earlier are not affected. Mitigation Running only PV or PVM guests will avoid the vulnerability. Resolution Applying the appropriate attached patch resolves this issue. Note: Patches for released versions are generally prepared to apply to the stable branches and may not apply cleanly to the most recent release tarballs. Downstream distributors are encouraged to update to the tip of the stable branch before applying these patches. Patch Files Patch Content Deployment During Embargo The deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo period, even on public-facing systems with untrusted guest users and administrators. However: Distribution of updated software is prohibited (except to other members of the pre-disclosure list). Pre-disclosure list members who wish to deploy significantly different patches and/or mitigations should contact the Xen Project Security Team. (Note: This during-embargo deployment notice is retained in post-embargo publicly released Xen Project announcements, even though it is no longer applicable at that stage. This is done to enable community oversight of the Xen Project Security Team's decision-making.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security/policy.html --- Signature Information XenProject.org Security Team

Goal Reached Thanks to every supporter — we hit 100%!

Xen XSA-503: Out-of-bounds read in vRTC emulation (CVE-2026-62430)