Vulnerability · Published Jul 28, 2026 · Assigned by XEN
CVE-2026-62427sysctl and platform-op locks open to abuse
High 8.8
In plain English
A high-severity improper access control in Xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | xen | 4.19.6-r0 | ALPINE-CVE-2026-62427 |
| Alpine:v3.22 | xen | 4.20.4-r0 | ALPINE-CVE-2026-62427 |
| Alpine:v3.23 | xen | 4.20.4-r0 | ALPINE-CVE-2026-62427 |
| Alpine:v3.24 | xen | 4.21.2-r0 | ALPINE-CVE-2026-62427 |
| Debian:12 | xen | 4.17.7-0+deb12u1 | DEBIAN-CVE-2026-62427 |
| Debian:13 | xen | 4.20.3+127-gc42374a105-0+deb13u1 | DEBIAN-CVE-2026-62427 |
| Debian:14 | xen | 4.20.3+127-gc42374a105-1 | DEBIAN-CVE-2026-62427 |
| Ubuntu:22.04:LTS | xen | no fix listed | UBUNTU-CVE-2026-62427 |
| Ubuntu:24.04:LTS | xen | no fix listed | UBUNTU-CVE-2026-62427 |
| Ubuntu:26.04:LTS | xen | no fix listed | UBUNTU-CVE-2026-62427 |
| Ubuntu:26.10 | xen | no fix listed | UBUNTU-CVE-2026-62427 |
Affected products (as reported)
Weakness: CWE-284, CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H