Bug 2479878 (CVE-2026-23557) - CVE-2026-23557 xenstored: xen: Xenstored: Denial of Service via XS_RESET_WATCHES command
Summary: CVE-2026-23557 xenstored: xen: Xenstored: Denial of Service via XS_RESET_WATC...
Keywords:
Status: NEW
Alias: CVE-2026-23557
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2483744
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-19 14:03 UTC by OSIDB Bzimport
Modified: 2026-06-09 08:55 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-19 14:03:53 UTC 
Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES
command within a transaction due to an assert() triggering.

In case xenstored was built with NDEBUG #defined nothing bad will
happen, as assert() is doing nothing in this case. Note that the
default is not to define NDEBUG for xenstored builds even in release
builds of Xen.
Note You need to log in before you can comment on or make changes to this bug.