Bug 2508027 (CVE-2026-62430)

Summary:	CVE-2026-62430 xen: Xen: Out-of-bounds read due to concurrent CMOS memory access
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Xen. This vulnerability allows a guest operating system to read data beyond its intended memory boundaries, potentially leading to information disclosure. The issue arises from improper synchronization during access to the CMOS (Complementary Metal-Oxide-Semiconductor) memory. A guest could manipulate an index used for memory access after it has been validated, resulting in an out-of-bounds read.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2508143
Bug Blocks:

Description OSIDB Bzimport 2026-07-28 14:02:43 UTC

Accesses to the CMOS memory contents are done using an indirect IO port
pair.  Therefore Xen needs to cache the guest chosen index, and one of
the usages of the index didn't take the necessary locking to avoid
concurrent changes.  As a result, a guest could change the index after
it being checked, causing a subsequent out-of-bound read access to the
contents of an array.