CVE-2026-62437: Guest Termination Race Condition Vulnerability

CVE-2026-62437 Overview

CVE-2026-62437 is a race condition in the Xen hypervisor affecting the cleanup path for PCI devices assigned to guests. When a guest is terminated, Xen releases PCI device assignments and tears down the tracking structures for interrupt request lines (IRQs) used by those devices. A terminating guest can direct its device model (DM) to rebind one or more IRQs after cleanup has already begun, causing new tracking structures to be created. At least one such structure is not freed during subsequent cleanup, resulting in a resource leak within the hypervisor.

Critical Impact
A malicious or buggy guest can trigger a hypervisor-side resource leak during termination, leading to denial of service conditions affecting the host and other guests on the same system.

Affected Products

Xen hypervisor (versions supporting PCI passthrough with device model IRQ binding)
Systems using HVM guests with PCI device passthrough
Multi-tenant virtualization hosts running Xen

Discovery Timeline

2026-09-08 - CVE-2026-62437 published to NVD alongside Xen Security Advisory 509
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-62437

Vulnerability Analysis

The flaw is classified under [CWE-362] as a concurrent execution using shared resource with improper synchronization (race condition). When a Xen guest is torn down, PCI device cleanup and the associated IRQ tracking structure removal execute relatively early in the termination sequence. The termination process is not fully atomic with respect to the guest's device model.

After PCI cleanup completes but before the guest is fully destroyed, the guest can still cause its device model to bind IRQs anew. This late binding re-creates tracking structures the hypervisor has already released. Later cleanup stages handle most of these regenerated structures, but at least one is missed. Each termination of a specially crafted guest can therefore leave orphaned hypervisor state behind.

Root Cause

The root cause is the ordering of PCI passthrough teardown relative to device model IRQ bind operations. The hypervisor assumes that after PCI device cleanup, no additional IRQ tracking structures will be created for the guest. That assumption does not hold because the device model retains the ability to bind IRQs until later in the shutdown sequence. The mismatch between cleanup ordering and permitted late operations produces the leak.

Attack Vector

Exploitation requires local access with low privileges inside a guest that has been granted PCI passthrough. The attacker triggers guest termination while inducing the device model to bind IRQs during the vulnerable window. No user interaction is required. The scope is changed because impact extends from the guest to the hypervisor host. Confidentiality and integrity are not affected, but availability of the host can be degraded through cumulative resource exhaustion.

See the Xen Project Security Advisory 509 for authoritative technical details and patch information.

Detection Methods for CVE-2026-62437

Indicators of Compromise

Unexplained growth in hypervisor memory usage over time on hosts running guests with PCI passthrough
Repeated guest create-and-destroy cycles originating from a single tenant, particularly HVM guests configured with assigned PCI devices
IRQ tracking entries persisting in hypervisor state after the corresponding guest domain has been destroyed

Detection Strategies

Audit xl list and hypervisor logs (xl dmesg) for patterns of rapid domain creation and destruction combined with PCI passthrough usage
Monitor Xen internal allocations for IRQ-related structures that survive guest teardown by correlating pre- and post-destroy state
Compare hypervisor free memory across reboot cycles on affected hosts to identify slow leaks tied to guest lifecycle events

Monitoring Recommendations

Enable verbose hypervisor logging for domain destruction events and IRQ bind/unbind operations on hosts that run passthrough workloads
Track per-tenant guest lifecycle telemetry and alert on abnormal termination rates for guests holding PCI assignments
Baseline hypervisor memory and IRQ allocation counts, and alert on sustained upward trends that do not correlate with running guest counts

How to Mitigate CVE-2026-62437

Immediate Actions Required

Apply the patches referenced in Xen Security Advisory 509 to all Xen hosts running affected versions
Inventory hosts that expose PCI passthrough to guests and prioritize them for patching
Restrict PCI passthrough to trusted tenants until patches are deployed on multi-tenant hosts

Patch Information

The Xen Project has released patches through XSA-509. Distribution maintainers publish rebuilt hypervisor packages that incorporate the fix. Review the Openwall OSS-Security discussion for coordinated distribution timing and applicability to specific Xen versions.

Workarounds

Disable PCI passthrough for guests that do not require it, eliminating the code path involved in the race condition
Reboot hypervisor hosts on a scheduled basis to reclaim leaked resources until patches are applied
Limit which tenants can request guest destruction and PCI operations by tightening toolstack access controls

bash

# Verify running Xen hypervisor version
xl info | grep xen_version

# List guests currently holding PCI passthrough assignments
for dom in $(xl list | awk 'NR>1 {print $1}'); do
  echo "Domain: $dom"
  xl pci-list "$dom"
done