This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-42493 →

DEBIAN-CVE-2026-42493

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out ove...

Original description

The description as published by the source.

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 xen

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7-0+deb12u1"}]}]

Debian:13 xen

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3+127-gc42374a105-0+deb13u1"}]}]

Debian:14 xen

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3+127-gc42374a105-1"}]}]

References

advisory security-tracker.debian.org