Xen Security Advisory 512 v3 (CVE-2026-79604) - oxenstored: Unbounded accumulation of watches
Xen Project released XSA-512 (CVE-2026-79604) fixing unbounded accumulation of watches in oxenstored that can exhaust resources after xenbus reconnects.
Xen Security Advisory 512 v3 publicly discloses CVE-2026-79604 in oxenstored, the OCaml xenstore implementation. Oxenstored maintains a global trie and per-domain hashtable for watches, and on a xenbus reconnect requests the watches are not cleared out of the global structure. This allows unbounded accumulation of watches. The Xen security team published the advisory and fix as a public release.
30