7.5
High
CVE-2026-62430 Accesses to the CMOS memory contents are done using an indirect IO port pair
Description
Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| xen | Versions not published |
Other CVEs of xen
The 142 CVEs of xen →
CVE-2026-102703
arbitrary read/write via grant copy
4.4
Medium
CVE-2026-102704
arbitrary read/write via grant copy
4.4
Medium
CVE-2026-102700
With its original introduction, GNTTAB_cache_flush was made available
uniformly
4.7
Medium
CVE-2026-102702
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…
7.5
High