Xen XSA-514: Unprivileged Guest DoS via Xenstore Live Update Crash

Vulnerability Overview Vulnerability ID: XSA-514 CVE ID: CVE-2026-79607 Title: Xenstore: Guests can crash xenstored during Live Update Publication Date: 2026-10-13 12:00 Update Date: 2026-10-13 12:28 Version: 2 Description During the Xenstore Live Update process, if a Xenstore state record with a specific watch depth is written with two bytes missing, it leads to an inconsistent state when reading the state in the new Xenstore, causing Xenstore to crash or resulting in corrupted Xenstore data. Impact An unauthorized virtual machine (guest) can cause the Xenstore service to crash or become corrupted, leading to failures in domain management operations on the host during Xenstore Live Update. Affected Systems Only Xen 4.22 systems are vulnerable. Systems running Xen 4.21 or earlier are not affected. Xen systems running exclusively as a daemon or in stubdom mode are vulnerable. Systems running xenstored are not affected. Mitigations Avoiding Xenstore Live Update prevents the vulnerability. Switching to xenstored prevents the vulnerability. Resolution Apply the accompanying patch to resolve this issue. Patch File Filename: xsa514.patch SHA256 Checksum: 877409b45db7585156db7699eb6d5e379311bd3d429d949dc29456d141ae7d_xsa514.patch Patch Verification Command Patch Deployment Notes The patch is intended for the stable branch and may not apply directly to the latest release version. Downstream users are encouraged to update to the top of the stable branch before applying the patch. Pre-Dissemination Restrictions During the embargo period, deploying the patch is not allowed on any system, even those open to the public (except for unauthorized guest users and administrators). Using avoidance of Xenstore Live Update as a mitigation is permitted. Switching to xenstored is not permitted, as it would change the visible configuration. Members of the pre-disclosure list who wish to deploy significantly different patches and/or mitigations should contact the Xen Project Security Team. Discoverers Andrii Sultanov of Yates Source XenProject.org Security Team

Goal Reached Thanks to every supporter — we hit 100%!

Xen XSA-514: Unprivileged Guest DoS via Xenstore Live Update Crash