DEBIAN-CVE-2026-62432

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-62432
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62432.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-62432
Upstream
  • CVE-2026-62432
Published
2026-07-28T13:19:02Z
Modified
2026-09-14T17:03:11Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.

References

Affected packages

Debian:12 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.17.1+2-gb773c48e36-1
4.17.2-1
4.17.2+55-g0b56bed864-1
4.17.2+76-ge1f9cb16e2-1~deb12u1
4.17.2+76-ge1f9cb16e2-1
4.17.3+10-g091466ba55-1~deb12u1
4.17.3+10-g091466ba55-1
4.17.3+10-g091466ba55-1.1~exp1
4.17.3+10-g091466ba55-1.1~exp2
4.17.3+10-g091466ba55-1.1
4.17.3+36-g54dacb5c02-1
4.17.5+23-ga4e5191dc0-1
4.17.5+23-ga4e5191dc0-1+deb12u1
4.17.5+72-g01140da4e8-1
4.19.0+14-g0918434e0f-1~exp1
4.19.1-1~exp1
4.19.1-1~exp4
4.19.1-1
4.20.0~rc2+1-gfcde5e0de8-1~exp1
4.20.0-1
4.20.0+68-g35cb38b222-1
4.20.2+7-g1badcf5035-1
4.20.2+7-g1badcf5035-2
4.20.2+37-g61ff35323e-1
4.20.3+127-gc42374a105-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62432.json"

Debian:13 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.20.3+127-gc42374a105-0+deb13u1

Affected versions

4.*
4.20.0+68-g35cb38b222-1
4.20.2+7-g1badcf5035-0+deb13u1
4.20.2+7-g1badcf5035-1
4.20.2+7-g1badcf5035-2
4.20.2+37-g61ff35323e-0+deb13u1
4.20.2+37-g61ff35323e-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62432.json"

Debian:14 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.20.3+127-gc42374a105-1

Affected versions

4.*
4.20.0+68-g35cb38b222-1
4.20.2+7-g1badcf5035-1
4.20.2+7-g1badcf5035-2
4.20.2+37-g61ff35323e-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62432.json"