CVE-2026-62437

Awaiting Analysis Awaiting Analysis - Queue

PCI Device IRQ Tracking Cleanup Failure in Xen

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: Xen Project

Description

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-62437

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper cleanup of PCI devices assigned to terminated guests in a virtualization environment. When a guest is terminated, cleanup processes remove tracking structures for IRQs used by PCI devices. However, the terminated guest could cause its device model to re-establish these tracking structures by rebinding IRQs. This leads to incomplete cleanup, leaving at least one tracking structure active.

Impact Analysis

This vulnerability could allow a terminated guest to retain access to system resources through leftover tracking structures. This might enable unauthorized interactions with PCI devices or IRQs, potentially leading to data leaks, privilege escalation, or denial of service in the virtualized environment.

Compliance Impact

This vulnerability could impact compliance by potentially allowing unauthorized access to sensitive data or system resources. For GDPR, it may violate data protection principles. For HIPAA, it could compromise protected health information. Organizations must ensure proper cleanup to maintain compliance with these regulations.

Mitigation Strategies

Apply the latest security patches or updates from Xen.org to address the cleanup issue with PCI devices and IRQ tracking during guest termination.

Hi! I’m here to help you understand CVE-2026-62437. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70