CVE-2026-62432 evtchn: Race between FIFO expand and reset

High 7.3 Published 28 Jul 2026 Updated 28 Jul 2026

A race condition in Xen's event channel handling can cause a NULL pointer dereference, leading to a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-62432?

CVE-2026-62432 is a high-severity vulnerability in Xen, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.

Weakness: CWE-362

Which versions are affected by CVE-2026-62432?

How do I fix CVE-2026-62432?

Apply the vendor's patch.

Is CVE-2026-62432 being exploited?

There is no known exploitation of CVE-2026-62432 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-62432, DEBIAN-CVE-2026-62432, GHSA-92f9-q54w-fxm8, UBUNTU-CVE-2026-62432.