CVE-2026-42487

The vulnerability arises from missing synchronization while traversing the linked list used for HVM guest I/O port translations in the Xen hypervisor. When a guest performs port accesses, the list may be concurrently updated, creating a race condition that can result in the hypervisor following stale or invalid pointers. This flaw may allow a malicious HVM guest to cause host crashes, recover sensitive memory contents, or otherwise degrade system integrity. The weakness is identified as CWE-362, a classic race condition.

All Xen hypervisor installations that support x86 HVM guests are potentially affected. No explicit product version is listed, so any Xen build that implements the XEN_DOMCTL_ioport_mapping mechanism for I/O port translation is at risk.

The CVSS score of 7.9 places this flaw in the high severity category. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires a malicious HVM guest to orchestrate concurrent port accesses and list updates; the description infers that such a race can be triggered by carefully timed I/O operations. While the exploit conditions are not trivial, the potential impact on confidentiality, integrity, and availability makes the risk significant for environments running unmodified Xen hypervisors.