CVE-2026-42488

Summary

Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache.

Affected Software

Weaknesses

Workarounds

Running only HVM or PVH guests will avoid the vulnerability.

Running PV guests in the PV shim will also avoid the vulnerability.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

CVE Program Container

Additional References

• http://xenbits.xen.org/xsa/advisory-494.html
• http://www.openwall.com/lists/oss-security/2026/06/09/14

References

• https://xenbits.xenproject.org/xsa/advisory-494.html

• ←Previous
• Next→