CVE-2026-23553

Katalog CVE

CVSS 2.9 · Low EPSS 0,14%

Kerentanan Improper Initialization pada xen. Skor CVSS 3.1 2.9 (Low) menurut CISA ADP.

Deskripsi (NVD)

In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1) vCPU runs on CPU A, running task 1. 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB. 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB. 4) vCPU moves back to CPU A. Xen skips IBPB again. Now, task 2 is running on CPU A with task 1's training still in the BTB.

Rincian

Terbit di NVD

28 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.9 (Low), sumber CISA ADP
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-665: Improper Initialization
CWE-693: Protection Mechanism Failure

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 3,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://xenbits.xenproject.org/xsa/advisory-479.html mitigasi · patch · advisory vendor
• http://xenbits.xen.org/xsa/advisory-479.html mitigasi · patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/01/27/3 mailing list · mitigasi · patch · advisory pihak ketiga