CVE-2026-23553
Low · 2.9CVSS
2.9
EPSS
0.1%
Published
Jan 28, 2026
CISA due date
—
The record
In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1) vCPU runs on CPU A, running task 1. 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB. 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB. 4) vCPU moves back to CPU A. Xen skips IBPB again. Now, task 2 is running on CPU A with task 1's training still in the BTB.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | xen | 0 | 4.17.5-1.git20251028.2.mga9 |
| SUSE:Linux Enterprise Micro 5.3 | xen | 0 | 4.16.7_06-150400.4.78.1 |
| SUSE:Linux Enterprise Micro 5.4 | xen | 0 | 4.16.7_06-150400.4.78.1 |
| openSUSE:Leap 15.6 | xen | 0 | 4.18.5_10-150600.3.37.1 |
| openSUSE:Tumbleweed | xen | 0 | 4.21.0_04-1.1 |
Related vulnerabilities
- CVE-2025-58150 Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter… Also affects xen
- CVE-2024-53241 In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV… Also affects xen
- CVE-2024-53240 In the Linux kernel, the following vulnerability has been resolved: xen/netfront: fix… Also affects xen
- CVE-2024-45818 The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the… Also affects xen
- CVE-2024-45819 PVH guests have their ACPI tables constructed by the toolstack. Also affects xen
- CVE-2024-31145 Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via… Also affects xen
- CVE-2024-31146 When multiple devices share resources and one of them is to be passed through to a guest… Also affects xen
- CVE-2024-45817 In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions… Also affects xen