CVE catalog
CVE-2026-23555
Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path.
- Severity
- High · CVSS 7.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.18% · Oct 27, 2026
Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Note that the crash is forced via a failing assert() statement in xenstored. In case xenstored is being built with NDEBUG #defined, an unprivileged guest trying to access the node path "/local/domain/" will result in it no longer being serviced by xenstored, other guests (including dom0) will still be serviced, but xenstored will use up all cpu time it can get.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | xen | sid | 4.20.4+39-gf1e1321c87-1 | fixed |
| Debian | xen | forky | 4.20.4+39-gf1e1321c87-1 | fixed |
| Debian | xen | trixie | 4.20.3+127-gc42374a105-0+deb13u1 | fixed |
| Debian | xen | trixie-security | 4.20.4+39-gf1e1321c87-0+deb13u1 | fixed |
| Debian | xen | bookworm | 4.17.5+72-g01140da4e8-1 | not affected |
| Debian | xen | bookworm-security | 4.17.7-0+deb12u1 | not affected |
| Alpine | xen | 3.20 | 4.18.5-r5 | fixed |
| Alpine | xen | 3.21 | 4.19.4-r2 | fixed |
| Alpine | xen | 3.22 | 4.20.2-r2 | fixed |
| Alpine | xen | 3.23 | 4.20.2-r2 | fixed |
| Alpine | xen | 3.24 | 4.21.0-r3 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | xen | source | sid | 4.20.3+127-gc42374a105-1 | unimportant | Not reported | Not reported |
| Debian | xen | source | forky | 4.20.3+127-gc42374a105-1 | unimportant | Not reported | Not reported |
| Debian | xen | source | trixie | 4.20.3+127-gc42374a105-0+deb13u1 | not yet assigned | Not reported | Not reported |
| Debian | xen | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Alpine | xen | apk | 3.20 | 4.18.5-r5 | Not reported | ALPINE-CVE-2026-23555 | Not reported |
| Alpine | xen | apk | 3.21 | 4.19.4-r2 | Not reported | ALPINE-CVE-2026-23555 | Not reported |
| Alpine | xen | apk | 3.22 | 4.20.2-r2 | Not reported | ALPINE-CVE-2026-23555 | Not reported |
| Alpine | xen | apk | 3.23 | 4.20.2-r2 | Not reported | ALPINE-CVE-2026-23555 | Not reported |
| Alpine | xen | apk | 3.24 | 4.21.0-r3 | Not reported | ALPINE-CVE-2026-23555 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [libxencall1]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxen-dev]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxendevicemodel1]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxenevtchn1]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxenforeignmemory1]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxengnttab1]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxenhypfs1]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxenmisc4.20]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxenstore4]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxentoolcore1]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [libxentoollog1]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [xen-doc]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· all · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· all · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· all · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· all · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· all · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [xen-hypervisor-4.20-amd64]Affected
Source package: [xen]
Details (3)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [xen-hypervisor-4.20-amd64-dbg]Affected
Source package: [xen]
Details (3)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [xen-hypervisor-4.20-arm64]Affected
Source package: [xen]
Details (2)
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [xen-hypervisor-4.20-arm64-dbg]Affected
Source package: [xen]
Details (2)
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [xen-hypervisor-common]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [xenstore-utils]Affected
Source package: [xen]
Details (5)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [xen-system-amd64]Affected
Source package: [xen]
Details (3)
4.20.2+37-g61ff35323e-0+deb13u1· amd64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· amd64 · trixie-security · Historical versionFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.4+39-gf1e1321c87-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
- [xen-system-arm64]Affected
Source package: [xen]
Details (2)
4.20.2+37-g61ff35323e-0+deb13u1· arm64 · trixieAffected · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
4.20.3+127-gc42374a105-0+deb13u1· arm64 · trixie-securityFixed · Fixed:
4.20.3+127-gc42374a105-0+deb13u1nvd · xen · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0908-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-23555]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-23555]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-23555]
- [https://security-tracker.debian.org/tracker/CVE-2026-23555]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23555.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0760.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]