Xen HVM DM_OP Buffer Check Flaw Leads to Stack Information Leakage (CVE-2026-62433)

Vulnerability Overview Vulnerability ID: CVE-2026-62433 / XSA-506 Publication Date: 2026-07-28 12:00 Last Updated: 2026-07-28 12:05 Version: 2 Title: Fix missing bounds check for DM_OP hypercalls Description Parts of the handling code assume that the caller has already provided the required number of buffers for a given operation, without performing any checks. Consequently, certain operations may access uninitialized structures, leading to information leakage from the stack. Impact HVM guests in the device model can gain insights into Xen stack contents, potentially leading to data leakage from other guest contexts. Affected Systems All Xen versions starting from 4.10 are affected. Xen versions 4.9 and earlier are not affected. Only entities controlling HVM guests can exploit this vulnerability. These device models run in dom0 or domU. Mitigations Running only PV or PVH guests avoids this vulnerability. (Switching from a device model stub domain to a fully protected dom0 device model does not mitigate this vulnerability. Instead, it simply reclassifies the vulnerability as "by design," thereby reclassifying these issues as "non-bugs." Using stub domains for running domU is still more secure than running domU with qemu-dm. Users and domU device model vendors should not change their configuration to use the dom0 QEMU process.) Solution Apply the provided patch to resolve this issue. Note: Published patches are typically prepared for application to stable branches and may not apply cleanly to the latest release versions. Downstream distributions are encouraged to update to the top of the stable branch before applying these patches. Patch Files SHA256 Checksums Constraints During Deployment During the embargo period, deployment of the aforementioned patch and/or mitigation (or something substantially similar) is permitted, even on publicly facing systems and even with untrusted guest users and administrators. However, distributing updated software to other members of the pre-disclosure list is prohibited. Members of the pre-disclosure list wishing to deploy significantly different patches and/or mitigations should contact the Xen Project Security Team. (Note: This embargo deployment notice will remain in the Xen Project announcement published publicly after the embargo ends, even if it is no longer applicable. This is to allow the community to oversee the decision-making of the Xen Project Security Team.) For more information on permitted use, refer to the Xen Project community security policy: https://www.xenproject.org/security/policy.html --- Xen Project Security Team

Goal Reached Thanks to every supporter — we hit 100%!

Xen HVM DM_OP Buffer Check Flaw Leads to Stack Information Leakage (CVE-2026-62433)