Access Control Vulnerability in Xen Project's Xenstored Service
CVE-2026-23555

7.1HIGH

Key Information:

Vendor

Xen Project
Status
Xen Project
Vendor
CVE Published:
23 March 2026

What is CVE-2026-23555?

A significant vulnerability exists in the Xenstored service within the Xen Project, where an unprivileged guest can exploit a flaw in the access control mechanism. By issuing a Xenstore command that targets an illegal node path such as '/local/domain/', the service may crash due to a faulty error indicator when verifying the node. If debug symbols are not included during the build, this issue can lead to prolonged CPU usage by xenstored, potentially affecting the performance of other guests. Proper patches are necessary to mitigate these issues and ensure robust control of node access.

Affected Version(s)

Xen consult Xen advisory XSA-481

References

https://xenbits.xenproject.org/xsa/advisory-481.html

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Marek Marczykowski-GĂłreckiof Invisible Things Lab.
.