CVE-2026-42490: domctl lock open to abuse

Published Jun 9, 2026

Updated

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489.

Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.

Affected Software

1 affected component

Xen Project Xen

Event History

Jun 18, 2026

CVE Published

via MITRE·01:47 PM

Data Sourced

via MITRE·01:47 PM

Description

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-42490?

CVE-2026-42490 has been classified as a medium severity vulnerability.

What is the nature of the vulnerability in CVE-2026-42490?

CVE-2026-42490 involves an abuse of the domctl lock in the Xen Hypervisor.

How do I fix CVE-2026-42490?

To fix CVE-2026-42490, it is recommended to apply the latest security patches provided by the Xen project.

Which software is affected by CVE-2026-42490?

CVE-2026-42490 affects the Xen Hypervisor software.

Is there a workaround for CVE-2026-42490?

Currently, no specific workaround has been published for CVE-2026-42490, and applying the patch is advised.