CVE-2026-62429
Received Received - Intake

vNUMA Configuration Access During Guest Domain Destruction

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Xen Project

Description
Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-62429
EUVD
EUVD-2026-49782

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xen xen From 4.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in the cleanup of vNUMA (virtual NUMA) domain configuration data in Xen. When a guest domain is being destroyed, the cleanup process is not properly synchronized with data retrieval by device models controlling the guest. This allows those device models to access vNUMA data even after destruction begins.

Detection Guidance

Detection requires checking Xen versions and vNUMA configurations. Verify if Xen 4.5 or later is running and if any guests have vNUMA enabled. Check logs for unusual device model activity during guest destruction. No specific commands are provided in the advisory.

Impact Analysis

The impact includes potential Denial of Service (DoS) affecting the entire host, information leaks, and in some cases privilege escalation. Only entities controlling guests, specifically device models running in stub domains or de-privileged in Dom0, can exploit this vulnerability, and only if the guest has vNUMA enabled.

Compliance Impact

This vulnerability could lead to information leaks, which may violate data protection requirements under GDPR and HIPAA. Unauthorized access to vNUMA configuration data during domain destruction could expose sensitive guest information, potentially resulting in compliance breaches.

Mitigation Strategies
  • Disable vNUMA for HVM guests if enabled.
  • Run only PV or PVH guests on x86 systems.
  • Apply available patches: xsa502.patch for Xen 4.22.0, xsa502-4.21.patch for Xen 4.21.x to 4.19.x, or xsa502-4.18.patch for Xen 4.18.x to 4.17.x.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart