XE
Product
Xen
490
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 16High 134Medium 162Low 11
Watch
Add Xen to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9379 | 7.9 | Jan 23 | The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the… Affected: All versions, or not specified |
| CVE-2026-23558 | 7.8 | May 19 | grant table v2 race in status page mapping Affected: 4.0.0 and later |
| CVE-2026-23554 | 7.8 | Mar 23 | Use after free of paging structures in EPT Affected: 4.17 and later |
| CVE-2023-34326 | 7.8 | Jan 5 | The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction (see stale DMA mappings)… Affected: All versions, or not specified |
| CVE-2023-34325 | 7.8 | Jan 5 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several… Affected: All versions, or not specified |
| CVE-2023-34322 | 7.8 | Jan 5 | For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode Affected: 3.2.0 before 4.15.0 |
| CVE-2023-34319 | 7.8 | Sep 22 | Linux: buffer overrun in netback due to unusual packet Affected: 3.2.0 and later |
| CVE-2022-42335 | 7.8 | Apr 25 | x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will… Affected: 4.17.0 |
| CVE-2022-42332 | 7.8 | Mar 21 | x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run… Affected: 3.2.0 and later |
| CVE-2022-33743 | 7.8 | Jul 5 | network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having… Affected: All versions, or not specified |
| CVE-2022-26361 | 7.8 | Apr 5 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to… Affected: All versions, or not specified |
| CVE-2022-26360 | 7.8 | Apr 5 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to… Affected: All versions, or not specified |
| CVE-2022-26359 | 7.8 | Apr 5 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to… Affected: All versions, or not specified |
| CVE-2022-26358 | 7.8 | Apr 5 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to… Affected: All versions, or not specified |
| CVE-2022-23033 | 7.8 | Jan 25 | arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping,… Affected: 4.12.0 and later |
| CVE-2021-28709 | 7.8 | Nov 24 | issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: 3.4.0 through 4.12.4; 4.13.0 through 4.13.4; 4.14.0 through 4.14.3; 4.15.0; 4.15.1 |
| CVE-2021-28705 | 7.8 | Nov 24 | issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: 3.4.0 through 4.12.4; 4.13.0 through 4.13.4; 4.14.0 through 4.14.3; 4.15.0; 4.15.1 |
| CVE-2021-28701 | 7.8 | Sep 8 | Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory Affected: 4.0.0 and later |
| CVE-2021-28697 | 7.8 | Aug 27 | grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory Affected: 4.0.0 through 4.15.0 |
| CVE-2021-27379 | 7.8 | Feb 18 | An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of service (host OS… Affected: 3.2.0 before 4.12.0 |
| CVE-2020-27671 | 7.8 | Oct 22 | An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain… Affected: 4.2.0 through 4.14.0 |
| CVE-2020-27670 | 7.8 | Oct 22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an… Affected: through 4.14.0 |
| CVE-2020-25603 | 7.8 | Sep 23 | An issue was discovered in Xen through 4.14.x Affected: through 4.14.0 |
| CVE-2020-25595 | 7.8 | Sep 23 | An issue was discovered in Xen through 4.14.x Affected: through 4.14.0 |
| CVE-2020-15852 | 7.8 | Jul 20 | An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests Affected: through 4.13.1 |
| CVE-2020-15567 | 7.8 | Jul 7 | An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE Affected: through 4.13.1 |
| CVE-2020-11739 | 7.8 | Apr 14 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write… Affected: through 4.13.0; 4.13.0; 4.13.0 |
| CVE-2019-17347 | 7.8 | Oct 8 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in… Affected: 4.1.0 through 4.11.2 |
| CVE-2019-17341 | 7.8 | Oct 8 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during… Affected: through 4.11.2 |
| CVE-2018-19963 | 7.8 | Dec 8 | An issue was discovered in Xen 4.11 allowing HVM guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because x86 IOREQ server resource… Affected: 4.11.0 |
| CVE-2018-19962 | 7.8 | Dec 8 | An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined… Affected: through 4.11.1 |
| CVE-2018-19961 | 7.8 | Dec 8 | An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU… Affected: through 4.11.1 |
| CVE-2018-15471 | 7.8 | Aug 17 | An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products Affected: through 4.11.0 |
| CVE-2018-14678 | 7.8 | Jul 28 | An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x Affected: through 4.11.0 |
| CVE-2018-8897 | 7.8 | May 8 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all… Affected: All versions, or not specified |
| CVE-2017-17566 | 7.8 | Dec 12 | An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain… Affected: through 4.9.1 |
| CVE-2017-17564 | 7.8 | Dec 12 | An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling… Affected: through 4.9.1 |
| CVE-2017-17563 | 7.8 | Dec 12 | An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for… Affected: through 4.9.1 |
| CVE-2017-15588 | 7.8 | Oct 18 | An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry Affected: 4.9.0 |
| CVE-2017-12136 | 7.8 | Aug 24 | Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free list corruption and host crash) or gain… Affected: 4.6.0; 4.6.1; 4.6.3; 4.6.4; 4.6.5; 4.6.6; +7 more |
| CVE-2016-10013 | 7.8 | Jan 26 | Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation Affected: through 4.8.0 |
| CVE-2016-9386 | 7.8 | Jan 23 | The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors… Affected: All versions, or not specified |
| CVE-2016-9382 | 7.8 | Jan 23 | Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash)… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.1.0; +33 more |
| CVE-2016-3157 | 7.8 | Apr 12 | The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to… Affected: 4.0.0 |
| CVE-2021-28702 | 7.6 | Oct 6 | PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") Affected: 4.13.0 through 4.15.1 |
| CVE-2025-58149 | 7.5 | Oct 31 | Incorrect removal of permissions on PCI device unplug Affected: 4.0.0 and later |
| CVE-2025-58148 | 7.5 | Oct 31 | x86: Incorrect input sanitisation in Viridian hypercalls Affected: 4.15.0 and later |
| CVE-2025-58147 | 7.5 | Oct 31 | x86: Incorrect input sanitisation in Viridian hypercalls Affected: 4.15.0 and later |
| CVE-2025-58145 | 7.5 | Sep 11 | Arm issues with page refcounting Affected: 4.12.0 before 4.17.0 |
| CVE-2025-58144 | 7.5 | Sep 11 | Arm issues with page refcounting Affected: 4.12.0 before 4.17.0 |