xen - Debian Package Tracker

general

source: xen (main)
version: 4.20.3+127-gc42374a105-1
maintainer: Debian Xen Team (archive) (DMD)
uploaders: Hans van Kranenburg [DMD] [DM] – Ian Jackson [DMD] – Maximilian Engelhardt [DMD]
arch: all amd64 arm64
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.14.6-1
o-o-sec: 4.14.5+94-ge49571868d-1
oldstable: 4.17.5+72-g01140da4e8-1
old-sec: 4.17.5+72-g01140da4e8-1
stable: 4.20.2+37-g61ff35323e-0+deb13u1
stable-sec: 4.20.3+127-gc42374a105-0+deb13u1
stable-p-u: 4.20.3+127-gc42374a105-0+deb13u1
testing: 4.20.3+127-gc42374a105-1
unstable: 4.20.3+127-gc42374a105-1

versioned links

4.14.5+94-ge49571868d-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.14.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.17.5+72-g01140da4e8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.20.2+37-g61ff35323e-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.20.3+127-gc42374a105-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.20.3+127-gc42374a105-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libxen-dev
libxencall1
libxendevicemodel1
libxenevtchn1
libxenforeignmemory1
libxengnttab1
libxenhypfs1
libxenmisc4.20
libxenstore4
libxentoolcore1
libxentoollog1
xen-doc
xen-hypervisor-4.20-amd64
xen-hypervisor-4.20-amd64-dbg
xen-hypervisor-4.20-arm64
xen-hypervisor-4.20-arm64-dbg
xen-hypervisor-common (1 bugs: 0, 1, 0, 0)
xen-system-amd64 (1 bugs: 0, 1, 0, 0)
xen-system-arm64
xen-utils-4.20
xen-utils-4.20-dbg
xen-utils-common (3 bugs: 0, 3, 0, 0)
xenstore-utils

action needed

4 security issues in sid high

There are 4 open security issues in sid.

4 important issues:

CVE-2026-62437: When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
CVE-2026-79602: A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
CVE-2026-79603: x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.
CVE-2026-79604:

Created: 2026-09-08 Last update: 2026-09-12 10:02

4 security issues in forky high

There are 4 open security issues in forky.

4 important issues:

CVE-2026-62437: When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
CVE-2026-79602: A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
CVE-2026-79603: x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.
CVE-2026-79604:

Created: 2026-09-08 Last update: 2026-09-12 10:02

33 security issues in bookworm high

There are 33 open security issues in bookworm.

27 important issues:

CVE-2025-10263: Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.
CVE-2025-54518: Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.
CVE-2026-42487: HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
CVE-2026-42488: Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache.
CVE-2026-42489: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.
CVE-2026-42490: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.
CVE-2026-42493: Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.
CVE-2026-42494: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
CVE-2026-42495: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
CVE-2026-62423: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
CVE-2026-62424: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
CVE-2026-62425: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
CVE-2026-62426: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
CVE-2026-62427: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
CVE-2026-62428: When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.
CVE-2026-62429: Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.
CVE-2026-62430: Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.
CVE-2026-62431: The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.
CVE-2026-62432: The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
CVE-2026-62433: Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.
CVE-2026-62434: A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.
CVE-2026-62435: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, as a bigger shared entry structure is then needed while the shared table doesn't change size. Switching from v2 back to v1 the status frames, which are separate in v2, go away. Code holding, but intermediately dropping and then re-acquiring the grant table lock, sometimes wrongly assumes that said properties wouldn't change across the window in time where the lock is not being held. The v1 -> v2 issue is CVE-2026-62435. The v2 -> v1 issue is CVE-2026-62436.
CVE-2026-62436: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, as a bigger shared entry structure is then needed while the shared table doesn't change size. Switching from v2 back to v1 the status frames, which are separate in v2, go away. Code holding, but intermediately dropping and then re-acquiring the grant table lock, sometimes wrongly assumes that said properties wouldn't change across the window in time where the lock is not being held. The v1 -> v2 issue is CVE-2026-62435. The v2 -> v1 issue is CVE-2026-62436.
CVE-2026-62437: When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
CVE-2026-79602: A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
CVE-2026-79603: x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.
CVE-2026-79604:

6 issues postponed or untriaged:

CVE-2025-54505: (needs triaging) A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially resulting in loss of confidentiality.
CVE-2025-58150: (postponed; to be fixed through a stable update) Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
CVE-2026-23553: (postponed; to be fixed through a stable update) In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1) vCPU runs on CPU A, running task 1. 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB. 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB. 4) vCPU moves back to CPU A. Xen skips IBPB again. Now, task 2 is running on CPU A with task 1's training still in the BTB.
CVE-2026-23554: (needs triaging) The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.
CVE-2026-23556: (needs triaging) When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. When the domain ID is eventually reused, the new domain can create fewer nodes before beeing deemed to be over quota.
CVE-2026-23558: (needs triaging) The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of the status pages may then be freed while mappings of them would still be inserted into the guest's secondary (P2M) page tables.

Created: 2026-01-27 Last update: 2026-09-12 10:02

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-09-12 16:22

lintian reports 69 warnings normal

Lintian reports 69 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-05-06 Last update: 2026-07-29 10:19

4 low-priority security issues in trixie low

There are 4 open security issues in trixie.

4 issues left for the package maintainer to handle:

CVE-2026-62437: (postponed; to be fixed through a stable update) When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.
CVE-2026-79602: (postponed; to be fixed through a stable update) A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
CVE-2026-79603: (postponed; to be fixed through a stable update) x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.
CVE-2026-79604: (postponed; to be fixed through a stable update)

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-09-08 Last update: 2026-09-12 10:02

debian/patches: 20 patches to forward upstream low

Among the 20 debian patches available in version 4.20.3+127-gc42374a105-1 of the package, we noticed the following issues:

20 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-07-29 12:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-07-29 06:00

news

[rss feed]

[2026-08-12] Accepted xen 4.20.3+127-gc42374a105-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2026-08-09] Accepted xen 4.20.3+127-gc42374a105-0+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2026-08-03] xen 4.20.3+127-gc42374a105-1 MIGRATED to testing (Debian testing watch)
[2026-07-28] Accepted xen 4.20.3+127-gc42374a105-1 (source) into unstable (Hans van Kranenburg)
[2026-03-06] Accepted xen 4.20.2+37-g61ff35323e-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Hans van Kranenburg)
[2026-02-26] xen 4.20.2+37-g61ff35323e-1 MIGRATED to testing (Debian testing watch)
[2026-02-21] Accepted xen 4.20.2+37-g61ff35323e-1 (source) into unstable (Hans van Kranenburg)
[2025-12-20] Accepted xen 4.20.2+7-g1badcf5035-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2025-12-13] xen 4.20.2+7-g1badcf5035-2 MIGRATED to testing (Debian testing watch)
[2025-12-08] Accepted xen 4.20.2+7-g1badcf5035-2 (source) into unstable (Maximilian Engelhardt) (signed by: Hans van Kranenburg)
[2025-12-05] Accepted xen 4.17.5+72-g01140da4e8-1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2025-12-02] Accepted xen 4.20.2+7-g1badcf5035-0+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2025-12-02] Accepted xen 4.17.5+72-g01140da4e8-1 (source) into oldstable-security (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2025-11-29] Accepted xen 4.20.2+7-g1badcf5035-1 (source) into unstable (Maximilian Engelhardt) (signed by: Hans van Kranenburg)
[2025-05-16] xen 4.20.0+68-g35cb38b222-1 MIGRATED to testing (Debian testing watch)
[2025-05-05] Accepted xen 4.20.0+68-g35cb38b222-1 (source) into unstable (Hans van Kranenburg)
[2025-03-12] xen 4.20.0-1 MIGRATED to testing (Debian testing watch)
[2025-03-07] Accepted xen 4.17.5+23-ga4e5191dc0-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Hans van Kranenburg)
[2025-03-06] Accepted xen 4.20.0-1 (source) into unstable (Maximilian Engelhardt) (signed by: Hans van Kranenburg)
[2025-02-14] Accepted xen 4.20.0~rc2+1-gfcde5e0de8-1~exp1 (all amd64 source) into experimental (Debian FTP Masters) (signed by: Sean Whitton)
[2025-01-27] Accepted xen 4.17.5+23-ga4e5191dc0-1 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2025-01-27] xen 4.19.1-1 MIGRATED to testing (Debian testing watch)
[2024-12-26] Accepted xen 4.17.5+23-ga4e5191dc0-1 (source) into stable-security (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2024-12-23] Accepted xen 4.19.1-1 (source) into unstable (Hans van Kranenburg)
[2024-12-21] Accepted xen 4.19.1-1~exp4 (amd64 source) into experimental (Debian FTP Masters) (signed by: Sean Whitton)
[2024-12-15] Accepted xen 4.19.1-1~exp1 (source) into experimental (Maximilian Engelhardt) (signed by: Hans van Kranenburg)
[2024-12-11] Accepted xen 4.19.0+14-g0918434e0f-1~exp1 (amd64 source) into experimental (Debian FTP Masters) (signed by: Sean Whitton)
[2024-04-26] xen 4.17.3+36-g54dacb5c02-1 MIGRATED to testing (Debian testing watch)
[2024-03-11] Accepted xen 4.17.3+36-g54dacb5c02-1 (source) into unstable (Hans van Kranenburg)
[2024-02-29] Accepted xen 4.17.3+10-g091466ba55-1.1 (source) into unstable (Steve Langasek)

bugs [bug history graph]

all: 35
RC: 2
I&N: 21
M&W: 12
F&P: 0
patch: 2

links

homepage
lintian (0, 69)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.20.3+127-gc42374a105-1
56 bugs (6 patches)