CVE-2026-42493
Received Received - Intake

Xen Hypervisor Denial of Service via Long Operations

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Xen Project

Description
Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-42493
EUVD
EUVD-2026-49770

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xen xen to 4.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the deprecation of x86 shadow paging in Xen due to performance and security concerns. Shadow paging can cause excessively long operations and preemption issues, leading to potential Denial of Service attacks. Alternatives like HAP for HVM/PVH guests and shim for PV guests are recommended.

Detection Guidance

Check if your Xen build is configured with SHADOW_PAGING=y by inspecting the build configuration or running 'xl info' to see active paging modes. Look for shadow paging usage in guest configurations or logs indicating excessive operation times.

Impact Analysis

An unprivileged guest could exploit this to cause a Denial of Service affecting the entire host. Systems running Xen with SHADOW_PAGING=y are vulnerable, except those on Xen 4.6 or earlier where shadow paging was always enabled.

Compliance Impact

This vulnerability primarily relates to a deprecated feature (x86 shadow paging) in Xen that could lead to Denial of Service (DoS) conditions. While it does not directly impact compliance with standards like GDPR or HIPAA, a DoS condition could indirectly affect availability requirements under these regulations, particularly for systems hosting sensitive data. Organizations must ensure they migrate to recommended alternatives (HAP or shim) to maintain operational stability and compliance.

Mitigation Strategies

Migrate HVM/PVH guests to HAP mode if possible. Apply the provided patches for your Xen version. Avoid using shadow paging for new deployments. For PV guests, no direct mitigation exists beyond avoiding shadow paging entirely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42493. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart