There are 4 open security issues in trixie.
4 issues left for the package maintainer to handle:
- CVE-2026-62437:
(postponed; to be fixed through a stable update)
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
- CVE-2026-79602:
(postponed; to be fixed through a stable update)
A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
- CVE-2026-79603:
(postponed; to be fixed through a stable update)
x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.
- CVE-2026-79604:
(postponed; to be fixed through a stable update)
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/x/xen.png){kind=link}