Bug 2508016 (CVE-2026-62432)

Summary: CVE-2026-62432 xen: Xen: Race condition in event channel handling can lead to denial of service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Xen. A timing issue, known as a race condition, exists in the event channel handling mechanism. This occurs when the system attempts to expand event channels without properly securing access, allowing another operation to interfere. This can lead to the system attempting to access an invalid memory location (a null pointer dereference), which may result in system instability or a denial of service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2508145    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-28 14:02:10 UTC 
The EVTCHNOP_expand_array hypercall checks for whether FIFO event
channels are enabled, but without holding the correct lock.  It can race
with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.