This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-42487 →
ALPINE-CVE-2026-42487
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_iop...
Original description
The description as published by the source.
HVM guest I/O port accesses are subject to either emulation or at least
translation. Translations are managed by the device model (via
XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed
at any time. Traversal of those lists (while handling guest I/O port
accesses) therefore needs synchronizing with updates, which was missing
so far.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.20
xen
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.5-r9"}]}]
Alpine:v3.21
xen
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.5-r4"}]}]
Alpine:v3.22
xen
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3-r4"}]}]
Alpine:v3.23
xen
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3-r4"}]}]
Alpine:v3.24
xen
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.1-r6"}]}]
References
- advisory security.alpinelinux.org