Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-42488: Xen on Debian/Alpine/Canonical may corrupt memory map
CVE-2026-42488 · published 4 months ago
Summary
The Xen hypervisor used in Debian, Alpine Linux, and Ubuntu can lose track of which memory tables are active when certain internal errors occur. This mismatch can corrupt the system's memory mapping, potentially leading to instability or data loss. Update Xen to the latest released version or apply the vendor's recommended patch to prevent the issue.
What to do
- Update alpine xen to version 4.19.5-r4.
- Update alpine xen to version 4.20.3-r4.
- Update alpine xen to version 4.21.1-r6.
- Update alpine xen to version 4.18.5-r9.
- Update debian xen to version 4.20.3+127-gc42374a105-0+deb13u1.
- Update debian xen to version 4.20.3+127-gc42374a105-1.
- Update xen to version 4.18.5-r9.
- Update xen to version 4.19.5-r4.
- Update xen to version 4.20.3-r4.
- Update xen to version 4.21.1-r6.
- Update debian xen to version 4.17.7-0+deb12u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | xen | All versions |
| Debian:12 | debian | xen |
< 4.17.7-0+deb12u1 Fix: upgrade to 4.17.7-0+deb12u1
|
| Debian:13 | debian | xen |
< 4.20.3+127-gc42374a105-0+deb13u1 Fix: upgrade to 4.20.3+127-gc42374a105-0+deb13u1
|
| Debian:14 | debian | xen |
< 4.20.3+127-gc42374a105-1 Fix: upgrade to 4.20.3+127-gc42374a105-1
|
| Alpine:v3.21 | alpine | xen |
< 4.19.5-r4 Fix: upgrade to 4.19.5-r4
|
| Alpine:v3.22 | alpine | xen |
< 4.20.3-r4 Fix: upgrade to 4.20.3-r4
|
| Alpine:v3.23 | alpine | xen |
< 4.20.3-r4 Fix: upgrade to 4.20.3-r4
|
| Alpine:v3.24 | alpine | xen |
< 4.21.1-r6 Fix: upgrade to 4.21.1-r6
|
| Ubuntu:16.04:LTS | canonical | xen | All versions |
| Ubuntu:18.04:LTS | canonical | xen | All versions |
| Ubuntu:20.04:LTS | canonical | xen | All versions |
| Ubuntu:22.04:LTS | canonical | xen | All versions |
| Ubuntu:24.04:LTS | canonical | xen | All versions |
| Ubuntu:25.10 | canonical | xen | All versions |
| Ubuntu:26.04:LTS | canonical | xen | All versions |
| Alpine:v3.20 | alpine | xen |
< 4.18.5-r9 Fix: upgrade to 4.18.5-r9
|
| Alpine:v3.20 | – | xen |
< 4.18.5-r9 Fix: upgrade to 4.18.5-r9
|
| Alpine:v3.21 | – | xen |
< 4.19.5-r4 Fix: upgrade to 4.19.5-r4
|
| Alpine:v3.22 | – | xen |
< 4.20.3-r4 Fix: upgrade to 4.20.3-r4
|
| Alpine:v3.24 | – | xen |
< 4.21.1-r6 Fix: upgrade to 4.21.1-r6
|
Original advisory text
Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata w...
Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache.
References
- https://security-tracker.debian.org/tracker/CVE-2026-42488 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-42488 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-42488 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-42488 Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-494.html Third Party Advisory
- https://xenbits.xenproject.org/xsa/advisory-494.html
- http://www.openwall.com/lists/oss-security/2026/06/09/14
- http://xenbits.xen.org/xsa/advisory-494.html
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-119Buffer Overflow
Timeline
Published18 Jun 2026
Updated4 Nov 2026
First seen11 Jun 2026
Sources
DEBIAN-CVE-2026-42488 · OSV
CVE-2026-42488 · NVD
ALPINE-CVE-2026-42488 · OSV
UBUNTU-CVE-2026-42488 · OSV
Track software like this
Free during beta