Bug 2529765 (CVE-2026-62437)

Summary: CVE-2026-62437 xen: Xen: Memory leak due to re-established IRQ tracking structures during guest termination
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Xen. When a guest virtual machine is terminated, its device model (DM) can re-establish interrupt request (IRQ) tracking structures after the initial cleanup. This prevents some of these structures from being properly deallocated, leading to a memory leak. A local attacker with control over a guest could exploit this to cause a denial of service (DoS) by exhausting system memory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2529850    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-08 12:47:05 UTC 
When guests are terminated, various pieces of cleanup need carrying out.
The cleaning up of PCI devices which were assigned to guests, and the
associated removal of tracking structures for IRQs used by the devices
occurs relatively early in the process.  Unfortunately after that point
the guest about to be terminated could cause its device model (DM) to
re-establish such tracking structures, by having it bind one or more IRQs
anew.  While some of those tracking structures would still be cleaned up
later on, at least one would not be.