New security update candidates for you to test!
A new XSA (Xen Security Advisory) was published on the 9th of September, and an update to Xen addresses it.
xen-*:
- Fix XSA-472 — Potential risks include Denial of Service (DoS) impacting the whole host, information exposure, or escalation of privileges. There are several vulnerabilities associated with the way guest memory pages are handled and accessed in the Viridian code:
- NULL pointer dereference during reference TSC area update — This issue occurs when the system tries to update the reference TSC area but encounters a NULL pointer. (CVE-2025-27466)
- NULL pointer dereference when delivering synthetic timer messages — This happens if the code assumes the SIM page is already mapped when a synthetic timer message must be delivered. (CVE-2025-58142)
- Race condition in reference TSC page mapping — A guest system can trigger Xen to release a memory page while it is still referenced in the guest’s physical-to-machine (p2m) page tables. (CVE-2025-58143)
Test on XCP-ng 8.2
yum clean metadata --enablerepo=xcp-ng-candidates
yum update --enablerepo=xcp-ng-candidates
reboot
The usual update rules apply: pool coordinator first, etc.
Versions:
xen: 4.13.5-9.49.4.xcpng8.2
What to test
- Normal use and anything else you want to test.
Test window before official release of the updates
~2 days.
Remarks
Another XSA (474) was released the same day regarding XAPI. Since the attack vector differs and is not easily exploitable in 8.2, we have not released a patch for it, unlike in 8.3.
As a reminder, XCP-ng 8.2 LTS will no longer be supported as of September 16, 2025.
We therefore strongly encourage you to migrate your pools to XCP-ng 8.3 LTS to continue benefiting from the latest security fixes and improvements.
