CVE-2026-23555
High · 7.1CVSS
7.1
EPSS
0.2%
Published
Mar 23, 2026
CISA due date
—
The record
Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Note that the crash is forced via a failing assert() statement in xenstored. In case xenstored is being built with NDEBUG #defined, an unprivileged guest trying to access the node path "/local/domain/" will result in it no longer being serviced by xenstored, other guests (including dom0) will still be serviced, but xenstored will use up all cpu time it can get.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | xen | 0 | 4.18.5_12-150600.3.40.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | xen | 0 | 4.18.5_12-150600.3.40.1 |
| openSUSE:Leap 15.6 | xen | 0 | 4.18.5_12-150600.3.40.1 |
| openSUSE:Tumbleweed | xen | 0 | 4.21.1_02-1.1 |
Related vulnerabilities
- CVE-2026-23554 The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state… Also affects xen
- CVE-2026-23553 In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning… Also affects xen
- CVE-2025-58150 Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter… Also affects xen
- CVE-2024-45818 The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the… Also affects xen
- CVE-2024-45819 PVH guests have their ACPI tables constructed by the toolstack. Also affects xen
- CVE-2024-31145 Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via… Also affects xen
- CVE-2024-31146 When multiple devices share resources and one of them is to be passed through to a guest… Also affects xen
- CVE-2024-45817 In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions… Also affects xen