pair. Therefore Xen needs to cache the guest chosen index, and one of
the usages of the index didn't take the necessary locking to avoid
concurrent changes. As a result, a guest could change the index after
it being checked, causing a subsequent out-of-bound read access to the
contents of an array.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Xen | Xen | unknown |
|
No data.
No data.
No data available yet.
Vendor Workaround
Running only PV or PVH guests will avoid the vulnerability.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://xenbits.xenproject.org/xsa/advisory-503.html |
|
Tue, 28 Jul 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array. | |
| Title | x86: Out-of-bounds read in vRTC emulation | |
| Weaknesses | CWE-362 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: XEN
Published:
Updated: 2026-07-28T16:33:30.367Z
Reserved: 2026-07-14T10:28:12.655Z
Link: CVE-2026-62430
Vulnrichment
Updated: 2026-07-28T16:33:30.367Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')