Bug 2508006 (CVE-2026-62426)

Summary:	CVE-2026-62426 xen: Xen: Denial of Service in sysctl operations due to unfair lock acquisition.
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Xen. The system's `sysctl` operations utilize a global lock that lacks fairness in its acquisition mechanism. Additionally, when Xen Security Modules (XSM) with Flask are active, this lock can be acquired before proper permission checks are performed. This vulnerability could allow a malicious guest (virtual machine) to repeatedly seize and hold the `sysctl` lock indefinitely, leading to a denial of service by preventing other guests and the control domain from performing critical system management operations.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2508149
Bug Blocks:

Description OSIDB Bzimport 2026-07-28 14:01:35 UTC

[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

To manage the system, sysctl and platform operations are used by the
control domain or a possible Xenstore domain.  Some of these operations
may not be executed in parallel, so a system-wide lock each is used.
The way those locks are acquired is, however, not providing any fairness.
Furthermore, with XSM/Flask in use, the lock acquire will, for some
operations, occur ahead of any permission checking.

The sysctl issue is CVE-2026-62426.

The platform-op issue is CVE-2026-62427.