Bug 2508028 (CVE-2026-42492)

Summary:	CVE-2026-42492 xen: Xen: Denial of Service in Xenstore via vIRQ event channel binding
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Xen. Unprivileged domains can trigger an error in the virtual interrupt request (vIRQ) event channel binding, specifically within the management of a bitmap related to the VIRQ_DOM_EXC. This error path can cause the bitmap to be improperly torn down, even if it was not correctly set up. This issue may disrupt Xenstore's ability to maintain an accurate view of the system's domains, potentially leading to a denial of service for Xenstore functionality.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2508142
Bug Blocks:

Description OSIDB Bzimport 2026-07-28 14:02:46 UTC

Xenstore, to have an up-to-date picture of the entire system, wants to
know of domains appearing and disappearing.  To make this more robust, a
new XEN_DOMCTL_get_domain_state was introduced.  The management of the
bitmap underlying that operation is tied into the binding of the
VIRQ_DOM_EXC virtual IRQ.  Unfortunately an error path there would tear
down the bitmap even in cases when it wasn't set up.  Unprivileged domains
can trigger that error path.