Xen Security Advisory 509 v3 (CVE-2026-62437) - x86: DMs may cause mem leak by IRQ binding
Xen Project released XSA-509 (CVE-2026-62437) fixing a memory leak in IRQ tracking when guests with assigned PCI devices are terminated.
Xen Security Advisory 509 v3 publicly discloses CVE-2026-62437, a memory leak affecting the Xen hypervisor on x86. When guests are terminated, cleanup of PCI devices assigned to those guests and removal of associated IRQ tracking structures may fail, leaking memory. The advisory was released publicly as version 3.
- CVE-2026-62437 assigned to the IRQ-tracking memory leak
- Occurs during guest teardown with assigned PCI devices on x86
- Leaked memory accumulates across guest lifecycle events
- Published as public Xen Security Advisory XSA-509 v3
- CVEs
- CVE-2026-62437
- Vendors
- Xen Project
- Products
- Xen
- Organizations
- Xen Project
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62437 | Memory leak in Xen hypervisor x86 IRQ tracking during guest teardown with PCI passthrough | 6.5 | <1% |
From the original article
Posted by Xen . org security team on Sep 08 Xen Security Advisory CVE-2026-62437 / XSA-509 version 3 x86: DMs may cause mem leak by IRQ binding UPDATES IN VERSION 3 ==================== Public release. ISSUE DESCRIPTION ================= When guests are terminated, various pieces of cleanup need carrying out.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.