CVE-2026-42495 Overview
CVE-2026-42495 is an integer underflow vulnerability in the libfsimage iso9660 driver used by the Xen Project. The flaw resides in the directory and Rock Ridge / System Use Sharing Protocol (SUSP) walk logic, which derives lengths directly from attacker-controlled on-disk fields without validation. Specifically, the calculation of the System Use area length may underflow when processing a crafted ISO 9660 filesystem image. An attacker with local access who convinces a privileged component to parse a malicious ISO image can trigger the underflow, leading to a denial of service condition. The issue is tracked under CWE-191: Integer Underflow.
Critical Impact
A crafted ISO 9660 image can trigger an integer underflow in libfsimage, resulting in high-impact availability loss for the affected component.
Affected Products
- Xen Project libfsimage iso9660 driver
- Components using libfsimage to parse ISO 9660 filesystem images
- Refer to the Xen Project Security Advisory XSA-497 for the authoritative list of affected versions
Discovery Timeline
- 2026-07-28 - CVE-2026-42495 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-42495
Vulnerability Analysis
The vulnerability exists in libfsimage's iso9660 driver, which parses ISO 9660 filesystem images including the Rock Ridge and SUSP extensions. The driver reads several length fields directly from the on-disk structures and uses them in size calculations without bounds checking. For CVE-2026-42495, the System Use area length is computed by subtracting values that originate from attacker-controlled fields, allowing the result to wrap below zero.
When the underflow occurs, the resulting value is treated as a large unsigned quantity. Subsequent parsing logic operates on this incorrect length, corrupting control flow and reading memory outside the intended buffer boundaries. The result is a crash of the parsing component. This flaw is one of five related issues disclosed together, alongside CVE-2026-42494, CVE-2026-62423, CVE-2026-62424, and CVE-2026-62425.
Root Cause
The root cause is missing validation of length fields read from the ISO 9660 directory record. The System Use area is located after the fixed directory record header and file identifier. The driver computes its size by subtracting the header and identifier lengths from the total record length. When the identifier length exceeds the remaining record space, the subtraction underflows an unsigned integer.
Attack Vector
Exploitation requires local access and user interaction, consistent with the CVSS vector AV:L/AC:L/PR:N/UI:R. An attacker crafts a malicious ISO 9660 image containing directory records with inconsistent length fields. When a privileged process such as a bootloader or virtual machine tooling parses the image, the underflow triggers and the process crashes. Confidentiality and integrity are not directly impacted, but availability loss is high.
The vulnerability manifests during parsing of the System Use area within iso9660 directory records. See the Xen Project Security Advisory XSA-497 for detailed technical analysis and patch information.
Detection Methods for CVE-2026-42495
Indicators of Compromise
- Unexpected crashes or terminations of processes that parse ISO 9660 images, particularly Xen pygrub or related bootloader tooling
- Presence of untrusted or user-supplied ISO 9660 images in virtual machine storage paths
- Log entries indicating parsing failures or segmentation faults in libfsimage consumers
Detection Strategies
- Monitor process exit codes and core dumps for tools that invoke libfsimage during guest boot or disk inspection
- Audit filesystem access to identify ISO 9660 images placed by unprivileged users or guest workloads
- Correlate crash telemetry with recent ISO image mounts to identify malicious images
Monitoring Recommendations
- Enable core dump collection on hypervisor management hosts and forward crash artifacts to a central store for analysis
- Track version deployment of libfsimage and Xen packages across the fleet to confirm patch coverage
- Alert on repeated parsing failures from the same source path or user context
How to Mitigate CVE-2026-42495
Immediate Actions Required
- Apply the patches referenced in Xen Project Security Advisory XSA-497 as soon as they are available in your distribution
- Restrict which users and workloads can supply ISO 9660 images to hypervisor tooling
- Inventory hosts running Xen with pygrub or other libfsimage consumers and prioritize them for patching
Patch Information
The Xen Project has published fixes in advisory XSA-497. Consult the Xen Project Security Advisory for the specific patches addressing the System Use area underflow along with the four related CVEs. Downstream Linux distributions will ship updated Xen packages once the advisory is public.
Workarounds
- Avoid parsing untrusted ISO 9660 images with pygrub or other tooling that links libfsimage
- Use alternative bootloader configurations such as direct kernel boot when possible
- Constrain guest disk formats to trusted image types until patches are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
