Memory leak in Xen hypervisor x86 IRQ tracking during guest teardown with PCI passthrough
AI analysis
CVE-2026-62437 is a memory leak in the Xen hypervisor on x86 systems involving tracking structures for IRQs used by PCI devices assigned to guests. When a guest is terminated, cleanup of assigned PCI devices and their IRQ tracking normally happens early, but the guest's device model (DM) can re-establish that tracking by binding one or more IRQs anew after cleanup has run, and at least one of those re-created structures is never freed. An attacker who controls a guest with assigned PCI devices could repeatedly terminate guests (or trigger re-binding before termination) to steadily consume host memory, ultimately degrading or DoS-ing the host. Only Xen deployments on x86 that use PCI device passthrough with a device model are affected; operators not using passthrough are not exposed. There is no public proof-of-concept, the issue is not in CISA KEV, EPSS is 0.2% (7th percentile), and no exploitation is known.
What to do: Check whether any x86 Xen hosts assign PCI devices to guests (passthrough, e.g. GPU or SR-IOV NIC assignment); if none do, you are not exposed. For affected hosts, update the hypervisor to a build containing the XSA-509 fix per the advisory's listed patched versions, and as an interim measure restrict passthrough to trusted guests and monitor/restart hosts to reclaim leaked memory.
Affected
| Xen Project ([email protected] CNA) Xen hypervisor, x86 hosts using PCI device passthrough with a device model | — |
Estimated exposure
largelikely tens of thousands of hosts (subset of Xen's broad cloud/hosting footprint that uses PCI passthrough) — Xen is widely deployed across public cloud and hosting platforms, but only x86 hosts actually using PCI device passthrough are affected, so this is an order-of-magnitude estimate from deployment patterns, not a measured count.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.