CVE-2026-42489General

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://xenbits.xenproject.org/xsa/advisory-492.html

Weakness type (CWE)

CWE-667

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-06-09); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification3 categories

General

133.3%

Patch

133.3%

Disclosure

133.3%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	1	General1
2026-06-10	1	Patch1
2026-06-18	1	Disclosure1

Full discourse3 posts

Anderson Nascimento@andersonc0d3137d
General
Xen Security Advisory 491 v2 (CVE-2026-42487) - x86 HVM I/O port list traversal https://seclists.org/oss-sec/2026/q2/857 Xen Security Advisory 492 v3 (CVE-2026-42489,CVE-2026-42490) - domctl lock open to abuse https://seclists.org/oss-sec/2026/q2/858 Xen Security Advisory 493 v2 (CVE-2025-10263) - Arm: Completion of memory accesses not guaranteed by completion of a TLBI https://seclists.org/oss-sec/2026/q2/859 Xen Security Advisory 494 v3 (CVE-2026-42488) - x86: mismatched mapcache metadata https://seclists.org/oss-sec/2026/q2/860
Post summary
The post enumerates Xen Security Advisories and their CVEs without providing details on exploitation, patches, or technical depth.
010143797
4.2K followersView on X
Open Source Security mailing list@oss_security128d
Disclosure
Xen Security Advisory 491 v2 (CVE-2026-42487) - x86 HVM I/O port list traversal https://www.openwall.com/lists/oss-security/2026/06/09/11 492 v3 (CVE-2026-42489,CVE-2026-42490) - domctl lock open to abuse https://www.openwall.com/lists/oss-security/2026/06/09/12
Post summary
The advisory announces three new Xen hypervisor CVEs with technical details regarding I/O port traversal and lock exploitation; no PoC, exploit code, active exploitation, patch info, or false positive claim are provided.
10041366
4.7K followersView on X
ThreatCluster@threatcluster135d
Patch
openSUSE released Xen security fixes for CVE-2026-42487, CVE-2026-42488, CVE-2026-42489 and CVE-2026-42490, with CVSS scores up to 8.8, according to advisories SUSE-2026-2328 and SUSE-2026-2329. https://threatcluster.io/cluster/opensuse-releases-important-xen-patches-for-multiple-vulnera-d10510c8
Post summary
OpenSUSE has released Xen patches for CVE‑2026‑42487‑42490, citing CVSS scores up to 8.8 and advisory references, with no evidence of PoC, exploit code, or active exploitation.
0000048
318 followersView on X

Explore more

Back to dashboard