CVE-2026-62432 - Vulnerability Details - OpenCVE

The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://xenbits.xenproject.org/xsa/advisory-505.html

History

Tue, 28 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
Title		evtchn: Race between FIFO expand and reset
References		https://xenbits.xenproject.org/xsa/advisory-505.html

MITRE

Status: PUBLISHED

Assigner: XEN

Published: 2026-07-28T12:32:52.043Z

Updated: 2026-07-28T16:33:32.509Z

Reserved: 2026-07-14T10:28:12.655Z

Link: CVE-2026-62432

Vulnrichment

Updated: 2026-07-28T16:33:32.509Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62432", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-07-14T10:28:12.655Z", "datePublished": "2026-07-28T12:32:52.043Z", "dateUpdated": "2026-07-28T16:33:32.509Z"}, "containers": {"cna": {"title": "evtchn: Race between FIFO expand and reset", "datePublic": "2026-07-28T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "The EVTCHNOP_expand_array hypercall checks for whether FIFO event\nchannels are enabled, but without holding the correct lock. It can race\nwith EVTCHNOP_reset, resulting in dereferencing a NULL pointer."}], "impacts": [{"descriptions": [{"lang": "en", "value": "A malicious HVM guest (x86 HVM or PVH, and ARM) can crash Xen leading to\na denial of service.\n\nA malicious x86 PV guest can most likely crash Xen leading to a denial\nof service, but memory corruption or privilege escalation cannot be\nruled out."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-505"}]}], "configurations": [{"lang": "en", "value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable."}], "workarounds": [{"lang": "en", "value": "There are no mitigations."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-505.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-07-28T12:32:52.043Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-505.html"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/28/21"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-28T16:33:32.509Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T15:13:34.638706Z", "id": "CVE-2026-62432", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T15:13:39.575Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-505.html"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/28/21"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-28T16:33:32.509Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-62432", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T15:13:34.638706Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T15:12:12.056Z"}}], "cna": {"title": "evtchn: Race between FIFO expand and reset", "impacts": [{"descriptions": [{"lang": "en", "value": "A malicious HVM guest (x86 HVM or PVH, and ARM) can crash Xen leading to\na denial of service.\n\nA malicious x86 PV guest can most likely crash Xen leading to a denial\nof service, but memory corruption or privilege escalation cannot be\nruled out."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-505"}], "defaultStatus": "unknown"}], "datePublic": "2026-07-28T12:00:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-505.html"}], "workarounds": [{"lang": "en", "value": "There are no mitigations."}], "descriptions": [{"lang": "en", "value": "The EVTCHNOP_expand_array hypercall checks for whether FIFO event\nchannels are enabled, but without holding the correct lock. It can race\nwith EVTCHNOP_reset, resulting in dereferencing a NULL pointer."}], "configurations": [{"lang": "en", "value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-07-28T12:32:52.043Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62432", "state": "PUBLISHED", "dateUpdated": "2026-07-28T16:33:32.509Z", "dateReserved": "2026-07-14T10:28:12.655Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2026-07-28T12:32:52.043Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}