DSA-6424-1 xen - security update
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, information disclosure or denial of service. https://security-tracker.debian.org/tracker/DSA-6424-1
CSIRTS triage
- What
- Multiple vulnerabilities in the Xen hypervisor permit privilege escalation, information disclosure, or denial of service.
- Who is affected
- Xen hypervisor deployments of unspecified versions.
- Urgency
- Moderate urgency; privilege escalation and information disclosure capabilities warrant prompt remediation.
- Action
- Apply security updates from Debian (DSA-6424-1) or consult Xen project advisories for affected versions.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Xen
Get an email when a new Xen advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00335.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2025-102630.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-545050.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-545180.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-235540.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-235550.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-235560.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-235570.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-235580.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-424870.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-424880.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilitiescert-bund
- high[UPDATE] [high] Microsoft Windows: Multiple vulnerabilitiescert-bund
- unknownUSN-8668-1: Linux kernel (GCP) vulnerabilitiesubuntu
- unknownMultiple vulnerabilities in Red Hat Linux kernel (August 21, 2026)cert-fr-avis
- unknownUSN-8665-1: Linux kernel (Raspberry Pi) vulnerabilitiesubuntu
- unknownUSN-8664-1: Linux kernel (NVIDIA BaseOS) vulnerabilitiesubuntu
- unknownUSN-8663-1: Linux kernel (NVIDIA) vulnerabilitiesubuntu
- high[UPDATE] [high] AMD Processor: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Red Hat Linux kernel (August 14, 2026)cert-fr-avis
- high[UPDATE] [high] Xen and Citrix Systems XenServer: Multiple vulnerabilitiescert-bund
- high[NEW] [high] Xen: Multiple vulnerabilitiescert-bund
- medium[UPDATE] [medium] Xen: Multiple vulnerabilitiescert-bund
More from Debian Security Advisories
- unknownDSA-6464-1 erlang - security update2026-08-25
- unknownDSA-6465-1 openssl - security update2026-08-25
- unknownDSA-6466-1 linux - security update2026-08-25
- unknownDSA-6462-1 zfs-linux - security update2026-08-24
- unknownDSA-6463-1 webkit2gtk - security update2026-08-24