Look up another CVE · open CVE-2026-72380 in the interactive tracker
CVE-2026-72380
xen/pvcalls: bound backend response req_id before indexing rsp[]
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/xen. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-72380 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
pvcalls_front_event_handler() takes req_id directly from the backend-supplied ring response and uses it to index the fixed-size bedata->rsp[] array for a memcpy() and a store, with no range check. A malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING and drive an out-of-bounds write past the bedata allocation. req_id was also declared int while the wire field rsp->req_id is u32, so a range check on the signed value alone is insufficient: a backend req_id of 0xffffffff becomes -1, passes a >= PVCALLS_NR_RSP_PER_RING test and indexes bedata->rsp[-1]. Declare req_id as u32 so a single bound covers both ends. A backend that sends an out-of-range req_id has violated the wire protocol, so rather than silently dropping the response, log once and stop trusting the backend: set bedata->disabled. The event handler then ignores further responses, and the request paths that wait for a response return -EIO instead of blocking forever. This mirrors the fatal-error handling xen-netback uses (xenvif_fatal_tx_err()). The pvcalls frontend currently trusts its backend, so this is not a classic-Xen security issue, but it matters for hardening PV frontends against malicious backends (confidential and disaggregated deployments).
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/xen/pvcalls-front.c
- What this is
- XEN HYPERVISOR INTERFACEMAINTAINERS section matched on drivers/xen/ · xen-devel@lists.xenproject.org · Supported
- Kernel module
- none to look for. The file would have gone into pvcalls_front, and Debian does not compile it into that module, so finding pvcalls_front in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_XEN|CONFIG_XEN_PVCALLS_FRONTEND' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_XEN, CONFIG_XEN_PVCALLS_FRONTEND
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.38%, higher than 29.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/xen
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.15 | 6.18.57 | bc8f2d1c6f7c |
| 4.15 | 7.1.5 | d1297a9e2fd6 |
| 4.15 | 7.2 | d33846c8dcc0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- The bug is reached when a malicious Xen PVCalls backend writes crafted responses into the shared grant-table ring and notifies the guest frontend via an inter-domain event channel; this is an adjacent on-host backend-to-guest path, not remote IP delivery to the guest.
- AC:LAttack complexity, low
- A compromised backend fully controls ring response contents and can set any req_id (including 0xffffffff for rsp[-1]) and re-notify the frontend IRQ at will; no races or attacker-uncontrollable heap layout are required to trigger the out-of-bounds write.
- PR:NPrivileges required, none
- No credentials inside the vulnerable guest are needed; once the pvcalls frontend is xenbus-connected to a backend, that backend alone can inject the malformed response. Backend/domain control is the attack position, not privileges obtainable in the guest via user namespaces.
- UI:NUser interaction, none
- No victim user or application action is required after xenbus binds the pvcalls frontend to its backend; backend-driven ring writes and event-channel interrupts alone reach pvcalls_front_event_handler() without mounts, socket use, or other interactive steps.
- S:UScope, unchanged
- The out-of-bounds write corrupts kmalloc heap memory and kernel objects within the guest running the pvcalls frontend. This is backend-to-guest hardening, not a demonstrated guest-to-host or hypervisor escape across the VM security boundary.
- C:HConfidentiality impact, high
- Backend-chosen req_id indexes bedata->rsp[] out of bounds for a ~20-byte memcpy plus req_id store, corrupting adjacent kernel heap memory (including rsp[-1] via the signed req_id bug) and enabling plausible arbitrary kernel memory disclosure if shaped further.
- I:HIntegrity impact, high
- The heap out-of-bounds write can overwrite adjacent kmalloc objects or allocator metadata, providing a credible path to arbitrary guest-kernel memory modification and control-flow hijack rather than being limited to a bounded or non-security integrity effect.
- A:HAvailability impact, high
- Corrupting kernel heap structures via the unbounded rsp[] indexing can immediately panic or oops the guest kernel; even unexploited attempts are likely to crash or disable the frontend, causing total loss of guest availability.