CVE-2026-23555

描述

Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Note that the crash is forced via a failing assert() statement in xenstored. In case xenstored is being built with NDEBUG #defined, an unprivileged guest trying to access the node path "/local/domain/" will result in it no longer being serviced by xenstored, other guests (including dom0) will still be serviced, but xenstored will use up all cpu time it can get.

如何修補 CVE-2026-23555

要修補 CVE-2026-23555,請將受影響套件升級到下列已修補版本。

• —升級至 4.18.5-r5 或更新版本

CVE-2026-23555 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 4.18.0, < 4.18.5-r5

CVSS 分數

參考連結(1)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-23555