Vulnerability · Published Jul 28, 2026 · Assigned by XEN
CVE-2026-42493x86 shadow paging is deprecated
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | xen | 4.19.6-r0 | ALPINE-CVE-2026-42493 |
| Alpine:v3.22 | xen | 4.20.4-r0 | ALPINE-CVE-2026-42493 |
| Alpine:v3.23 | xen | 4.20.4-r0 | ALPINE-CVE-2026-42493 |
| Alpine:v3.24 | xen | 4.21.2-r0 | ALPINE-CVE-2026-42493 |
| Debian:12 | xen | 4.17.7-0+deb12u1 | DEBIAN-CVE-2026-42493 |
| Debian:13 | xen | 4.20.3+127-gc42374a105-0+deb13u1 | DEBIAN-CVE-2026-42493 |
| Debian:14 | xen | 4.20.3+127-gc42374a105-1 | DEBIAN-CVE-2026-42493 |
| Ubuntu:22.04:LTS | xen | no fix listed | UBUNTU-CVE-2026-42493 |
| Ubuntu:24.04:LTS | xen | no fix listed | UBUNTU-CVE-2026-42493 |
| Ubuntu:26.04:LTS | xen | no fix listed | UBUNTU-CVE-2026-42493 |
| Ubuntu:26.10 | xen | no fix listed | UBUNTU-CVE-2026-42493 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H