CVE-2026-42490Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://xenbits.xenproject.org/xsa/advisory-492.html

Weakness type (CWE)

CWE-667

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 1 mentions (2026-06-09); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	1	Disclosure1
2026-06-10	1	Patch1
2026-06-18	1	Disclosure1

Full discourse3 posts

Anderson Nascimento@andersonc0d3137d
Disclosure
Xen Security Advisory 491 v2 (CVE-2026-42487) - x86 HVM I/O port list traversal https://seclists.org/oss-sec/2026/q2/857 Xen Security Advisory 492 v3 (CVE-2026-42489,CVE-2026-42490) - domctl lock open to abuse https://seclists.org/oss-sec/2026/q2/858 Xen Security Advisory 493 v2 (CVE-2025-10263) - Arm: Completion of memory accesses not guaranteed by completion of a TLBI https://seclists.org/oss-sec/2026/q2/859 Xen Security Advisory 494 v3 (CVE-2026-42488) - x86: mismatched mapcache metadata https://seclists.org/oss-sec/2026/q2/860
Post summary
The text enumerates several Xen security advisories with CVE identifiers and concise technical descriptions, but does not provide any PoC, exploit code, or evidence of active exploitation.
010143797
4.2K followersView on X
Open Source Security mailing list@oss_security128d
Disclosure
Xen Security Advisory 491 v2 (CVE-2026-42487) - x86 HVM I/O port list traversal https://www.openwall.com/lists/oss-security/2026/06/09/11 492 v3 (CVE-2026-42489,CVE-2026-42490) - domctl lock open to abuse https://www.openwall.com/lists/oss-security/2026/06/09/12
Post summary
The text announces three new CVEs discovered in the Xen hypervisor, detailing an I/O port list traversal flaw and a domctl lock abuse vulnerability.
10041366
4.7K followersView on X
ThreatCluster@threatcluster135d
Patch
openSUSE released Xen security fixes for CVE-2026-42487, CVE-2026-42488, CVE-2026-42489 and CVE-2026-42490, with CVSS scores up to 8.8, according to advisories SUSE-2026-2328 and SUSE-2026-2329. https://threatcluster.io/cluster/opensuse-releases-important-xen-patches-for-multiple-vulnera-d10510c8
Post summary
openSUSE has released patches for several Xen CVEs (CVE-2026-42487 to CVE-2026-42490) with CVSS scores up to 8.8, as detailed in SUSE advisories SUSE-2026-2328 and SUSE-2026-2329.
0000048
318 followersView on X

Explore more

Back to dashboard