CVE-2026-62427
Received Received - Intake

Xen Control Domain Privilege Escalation via Unfair Locking

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Xen Project

Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-62427
EUVD
EUVD-2026-49778

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
xen sysctl *
xen platform_operations *
xen xen *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62427 involves a lack of fairness in acquiring system-wide locks for platform operations in Xen. These locks are used by the control domain or a Xenstore domain to manage the system. The issue occurs because the lock acquisition process does not ensure fairness, and in some cases with XSM/Flask enabled, permission checks happen after the lock is acquired.

Impact Analysis

This vulnerability could lead to denial-of-service conditions where legitimate operations are blocked unfairly. It may also allow unauthorized access to sensitive operations if XSM/Flask is in use, as permission checks occur too late in the process.

Mitigation Strategies

Apply available patches for CVE-2026-62427 provided by Xen Project. Update Flask policies if using custom configurations. Check Xen versions from 4.0 onwards for affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62427. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart