Vulnerability Description
Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://xenbits.xenproject.org/xsa/advisory-503.html
- http://www.openwall.com/lists/oss-security/2026/07/28/19
- http://xenbits.xen.org/xsa/advisory-503.html
FAQ
What is CVE-2026-62430?
CVE-2026-62430 is a vulnerability with a CVSS score of 7.5 (HIGH). Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking...
How severe is CVE-2026-62430?
CVE-2026-62430 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-62430?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.