This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-42492 →

ALPINE-CVE-2026-42492

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XE...

Original description

The description as published by the source.

Xenstore, to have an up-to-date picture of the entire system, wants to
know of domains appearing and disappearing. To make this more robust, a
new XEN_DOMCTL_get_domain_state was introduced. The management of the
bitmap underlying that operation is tied into the binding of the
VIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear
down the bitmap even in cases when it wasn't set up. Unprivileged domains
can trigger that error path.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.24 xen

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.2-r0"}]}]

References

advisory security.alpinelinux.org