CVE-2026-62428

Name	CVE-2026-62428
Description	When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6424-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xen (PTS)	bullseye	4.14.6-1	vulnerable
	bullseye (security)	4.14.5+94-ge49571868d-1	vulnerable
	bookworm, bookworm (security)	4.17.5+72-g01140da4e8-1	vulnerable
	trixie	4.20.2+37-g61ff35323e-0+deb13u1	vulnerable
	trixie (security)	4.20.3+127-gc42374a105-0+deb13u1	fixed
	forky, sid	4.20.3+127-gc42374a105-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
xen	source	bullseye	(unfixed)	end-of-life
xen	source	trixie	4.20.3+127-gc42374a105-0+deb13u1		DSA-6424-1
xen	source	(unstable)	4.20.3+127-gc42374a105-1

[bullseye] - xen <end-of-life> (out of LTS support)
https://xenbits.xen.org/xsa/advisory-500.html