Xen Security Advisory 509 v3 (CVE-2026-62437) - x86: DMs may cause mem leak by IRQ binding

CVE-2026-62437 is a memory leak in the Xen hypervisor on x86 systems involving tracking structures for IRQs used by PCI devices assigned to guests. When a guest is terminated, cleanup of assigned PCI devices and their IRQ tracking normally happens early, but the guest's device model (DM) can re-establish that tracking by binding one or more IRQs anew after cleanup has run, and at least one of those re-created structures is never freed. An attacker who controls a guest with assigned PCI devices could repeatedly terminate guests (or trigger re-binding before termination) to steadily consume host memory, ultimately degrading or DoS-ing the host. Only Xen deployments on x86 that use PCI device passthrough with a device model are affected; operators not using passthrough are not exposed. There is no public proof-of-concept, the issue is not in CISA KEV, EPSS is 0.2% (7th percentile), and no exploitation is known.

Do: Check whether any x86 Xen hosts assign PCI devices to guests (passthrough, e.g. GPU or SR-IOV NIC assignment); if none do, you are not exposed. For affected hosts, update the hypervisor to a build containing the XSA-509 fix per the advisory's listed patched versions, and as an interim measure restrict passthrough to trusted guests and monitor/restart hosts to reclaim leaked memory.