{"affected":[{"ecosystem_specific":{"binaries":[{"xen-libs":"4.18.5_08-150600.3.34.2","xen-tools-domU":"4.18.5_08-150600.3.34.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","name":"xen","purl":"pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.18.5_08-150600.3.34.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"xen":"4.18.5_08-150600.3.34.2","xen-devel":"4.18.5_08-150600.3.34.2","xen-tools":"4.18.5_08-150600.3.34.2","xen-tools-xendomains-wait-disk":"4.18.5_08-150600.3.34.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","name":"xen","purl":"pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.18.5_08-150600.3.34.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"xen":"4.18.5_08-150600.3.34.2","xen-devel":"4.18.5_08-150600.3.34.2","xen-libs":"4.18.5_08-150600.3.34.2","xen-tools":"4.18.5_08-150600.3.34.2","xen-tools-domU":"4.18.5_08-150600.3.34.2","xen-tools-xendomains-wait-disk":"4.18.5_08-150600.3.34.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","name":"xen","purl":"pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.18.5_08-150600.3.34.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"xen":"4.18.5_08-150600.3.34.2","xen-devel":"4.18.5_08-150600.3.34.2","xen-libs":"4.18.5_08-150600.3.34.2","xen-tools":"4.18.5_08-150600.3.34.2","xen-tools-domU":"4.18.5_08-150600.3.34.2","xen-tools-xendomains-wait-disk":"4.18.5_08-150600.3.34.2"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","name":"xen","purl":"pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.18.5_08-150600.3.34.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"xen":"4.18.5_08-150600.3.34.2","xen-devel":"4.18.5_08-150600.3.34.2","xen-doc-html":"4.18.5_08-150600.3.34.2","xen-libs":"4.18.5_08-150600.3.34.2","xen-libs-32bit":"4.18.5_08-150600.3.34.2","xen-tools":"4.18.5_08-150600.3.34.2","xen-tools-domU":"4.18.5_08-150600.3.34.2","xen-tools-xendomains-wait-disk":"4.18.5_08-150600.3.34.2"}]},"package":{"ecosystem":"openSUSE:Leap 15.6","name":"xen","purl":"pkg:rpm/opensuse/xen&distro=openSUSE%20Leap%2015.6"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.18.5_08-150600.3.34.2"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for xen fixes the following issues:\n\nSecurity issues fixed:  \n\n- CVE-2025-27466: NULL pointer dereference in the Viridian interface when updating the reference TSC area (bsc#1248807).\n- CVE-2025-58142: NULL pointer dereference in the Viridian interface due to assumption that the SIM page is mapped when\n  a synthetic timer message has to be delivered (bsc#1248807).\n- CVE-2025-58143: information leak and reference counter underflow in the Viridian interface due to race in the mapping\n  of the reference TSC page (bsc#1248807).\n- CVE-2025-58147: incorrect input sanitisation in Viridian hypercalls using the HV_VP_SET Sparse format can lead to\n  out-of-bounds write through `vpmask_set()` (bsc#1251271).\n- CVE-2025-58148: incorrect input sanitisation in Viridian hypercalls using any input format can lead to out-of-bounds\n  read through `send_ipi()` (bsc#1251271).\n- CVE-2025-58149: incorrect removal of permissions on PCI device unplug allows PV guests to access memory of devices no\n  longer assigned to them (bsc#1252692).\n\nOther issues fixed:\n\n- Several upstream bug fixes (bsc#1027519).\n- Failure to restart xenstored (bsc#1254180).\n","id":"SUSE-SU-2026:0012-1","modified":"2026-01-05T10:31:27Z","published":"2026-01-05T10:31:27Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260012-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1027519"},{"type":"REPORT","url":"https://bugzilla.suse.com/1248807"},{"type":"REPORT","url":"https://bugzilla.suse.com/1251271"},{"type":"REPORT","url":"https://bugzilla.suse.com/1252692"},{"type":"REPORT","url":"https://bugzilla.suse.com/1254180"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-27466"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-58142"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-58143"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-58147"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-58148"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-58149"}],"related":["CVE-2025-27466","CVE-2025-58142","CVE-2025-58143","CVE-2025-58147","CVE-2025-58148","CVE-2025-58149"],"summary":"Security update for xen","upstream":["CVE-2025-27466","CVE-2025-58142","CVE-2025-58143","CVE-2025-58147","CVE-2025-58148","CVE-2025-58149"]}