Log in Start free

Vulnerability · Published Jun 9, 2022 · Assigned by XEN

CVE-2022-26362

Medium 6.4

In plain English

A medium-severity security flaw in xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.4Medium
Exploit odds (30 days)0.4%top 67.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too early and creates a window where the guest can re-establish the read/write mapping before writeability is prohibited.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xen4.16.1-r2ALPINE-CVE-2022-26362
Alpine:v3.21xen4.16.1-r2ALPINE-CVE-2022-26362
Alpine:v3.22xen4.16.1-r2ALPINE-CVE-2022-26362
Alpine:v3.23xen4.16.1-r2ALPINE-CVE-2022-26362
Alpine:v3.24xen4.16.1-r2ALPINE-CVE-2022-26362
Debian:12xen4.16.2-1DEBIAN-CVE-2022-26362
Debian:13xen4.16.2-1DEBIAN-CVE-2022-26362
Debian:14xen4.16.2-1DEBIAN-CVE-2022-26362
Ubuntu:22.04:LTSxenno fix listedUBUNTU-CVE-2022-26362
Ubuntu:24.04:LTSxenno fix listedUBUNTU-CVE-2022-26362
Ubuntu:25.10xenno fix listedUBUNTU-CVE-2022-26362
Ubuntu:26.04:LTSxenno fix listedUBUNTU-CVE-2022-26362
Ubuntu:26.10xenno fix listedUBUNTU-CVE-2022-26362

Affected products (as reported)

VendorProductVersions
Xen xen see references

References