CVE-2026-62432: evtchn: Race between FIFO expand and reset
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Xen Security Advisory 505 v2 (CVE-2026-62432) - Compensating control
Apply the Xen evtchn mitigation for Xen Security Advisory 505 v2 (CVE-2026-62432) addressing the race between FIFO expand and set/reset (dereferencing a NULL pointer).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62432?
CVE-2026-62432 has a risk score of 23, indicating a high severity level.
How do I fix CVE-2026-62432?
To fix CVE-2026-62432, upgrade to the latest version of the software where the vulnerability has been addressed.
What systems are affected by CVE-2026-62432?
CVE-2026-62432 primarily affects systems utilizing the evtchn component in the Xen hypervisor.
What are the potential impacts of CVE-2026-62432?
The potential impact of CVE-2026-62432 includes the risk of dereferencing a NULL pointer, leading to crashes or undefined behavior.
Is there a workaround for CVE-2026-62432?
Currently, there are no documented workarounds for CVE-2026-62432 other than applying patches or updates provided by the software maintainers.