CVE-2026-62437

NameCVE-2026-62437
DescriptionWhen guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xen (PTS)bookworm, bookworm (security)4.17.5+72-g01140da4e8-1vulnerable
trixie4.20.2+37-g61ff35323e-0+deb13u1vulnerable
trixie (security)4.20.3+127-gc42374a105-0+deb13u1vulnerable
forky, sid4.20.3+127-gc42374a105-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xensource(unstable)(unfixed)

Notes

https://xenbits.xen.org/xsa/advisory-509.html

Search for package or bug name: Reporting problems