CVE-2026-62428
Deferred Deferred - Pending Action

Grant Copy Operation Permission Check Bypass in Xen

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Xen Project

Description
When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-08-17
AI Q&A
2026-07-28
EPSS Evaluated
2026-08-16
NVD
CVE-2026-62428
EUVD
EUVD-2026-49779

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
xen xen From 4.2 (inc)
xen xen From 4.2.0 (inc)
xen xen to 4.1 (exc)
xen xen 4.18
xen xen 4.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62428 is a type confusion vulnerability in Xen's grant-copy operation. When a grant is already in use by another operation, inconsistencies may arise during permission checks. This can cause checks to be performed on a different page than the one involved in the copy, potentially allowing privilege escalation from an unprivileged guest to host level.

Detection Guidance

Detection requires analyzing Xen hypervisor logs for grant-copy operation inconsistencies. Check for repeated errors in dom0 logs related to grant-table operations. Use 'xl dmesg' to review hypervisor messages for abnormal grant handling. Monitor guest VMs for unexpected privilege escalation attempts.

Impact Analysis

This vulnerability may allow an unprivileged guest to gain host-level privileges, leading to potential system compromise. It could also result in information leaks or Denial of Service (DoS) attacks, disrupting normal operations.

Compliance Impact

This vulnerability could lead to privilege escalation, information leaks, or Denial of Service (DoS), which may violate compliance requirements under GDPR (data protection) or HIPAA (healthcare data security) by enabling unauthorized access or disrupting systems handling sensitive data.

Mitigation Strategies

Apply available patches (xsa500.patch for Xen 4.18.x or xsa500-4.17.patch for Xen 4.17.x). Disable grant table support if using Xen 4.13+ by setting CONFIG_GRANT_TABLE=n during build. Isolate untrusted guests to limit potential privilege escalation. Monitor Xen security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart