CVE-2026-62427
Description
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To manage the system, sysctl and platform operations are used by the
control domain or a possible Xenstore domain. Some of these operations
may not be executed in parallel, so a system-wide lock each is used.
The way those locks are acquired is, however, not providing any fairness.
Furthermore, with XSM/Flask in use, the lock acquire will, for some
operations, occur ahead of any permission checking.
The sysctl issue is CVE-2026-62426.
The platform-op issue is CVE-2026-62427.
Summary dbcve.org
CVE-2026-62427 is a vulnerability in the Xen hypervisor's platform-op subsystem where system-wide locks used to serialize certain platform operations lack fairness guarantees, potentially leading to starvation. Additionally, when XSM/Flask is enabled, lock acquisition occurs before permission checking, creating an authorization bypass where operations may hold locks before access control is validated.
Mitigation
Apply Xen hypervisor security patches when available. Consider whether XSM/Flask is required; if not, disabling it may reduce the attack surface. Ensure proper access controls on domains that can invoke platform operations.