CVE-2026-42487: x86 HVM I/O port list traversal

Published Jun 9, 2026

Updated

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XENDOMCTLioportmapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.

Affected Software

1 affected component

Xen Project Xen

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Xen Security Advisory 491 v2 (CVE-2026-42487)

Event History

Jun 18, 2026

CVE Published

via MITRE·01:46 PM

Data Sourced

via MITRE·01:46 PM

Description

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-42487?

CVE-2026-42487 has a severity rating of high, with a CVSS score of 7.9.

What are the potential impacts of CVE-2026-42487?

CVE-2026-42487 can lead to unauthorized access or manipulation of guest I/O port accesses due to a race condition.

How do I fix CVE-2026-42487?

To fix CVE-2026-42487, apply the security patches provided by the Xen Project for your version of Xen hypervisor.

What systems are affected by CVE-2026-42487?

CVE-2026-42487 affects systems running the Xen Project Xen hypervisor, particularly those utilizing HVM guests.

What is the nature of the vulnerability in CVE-2026-42487?

CVE-2026-42487 is classified as a race condition related to the traversal of a linked list for managing I/O port translations in HVM guest accesses.