{"id":"CVE-2026-62437","title":"When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early…","summary":"When guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cwe":["CWE-362"],"vendor":"Xen","product":"Xen","affected":["Xen"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:17:31.640","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62437","references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-509.html","label":"security@xen.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/08/6","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://xenbits.xen.org/xsa/advisory-509.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-62437.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-62437"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62437"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T18:11:30.445915Z"},"epss":0.00098,"epssPercentile":0.00888,"ingestedAt":"2026-09-08T15:33:26.984Z","slug":"CVE-2026-62437","body":"## Overview\n\nWhen guests are terminated, various pieces of cleanup need carrying out.\nThe cleaning up of PCI devices which were assigned to guests, and the\nassociated removal of tracking structures for IRQs used by the devices\noccurs relatively early in the process.  Unfortunately after that point\nthe guest about to be terminated could cause its device model (DM) to\nre-establish such tracking structures, by having it bind one or more IRQs\nanew.  While some of those tracking structures would still be cleaned up\nlater on, at least one would not be.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-62437.json)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201849,"id":"CVE-2026-62437","ts":1789399773864,"field":"cvss","old":null,"new":"6.5"},{"seq":201848,"id":"CVE-2026-62437","ts":1789399773864,"field":"severity","old":"none","new":"medium"},{"seq":200579,"id":"CVE-2026-62437","ts":1789397421532,"field":"cvss","old":"6.5","new":null},{"seq":200578,"id":"CVE-2026-62437","ts":1789397421532,"field":"severity","old":"medium","new":"none"},{"seq":198496,"id":"CVE-2026-62437","ts":1789392026200,"field":"cvss","old":null,"new":"6.5"},{"seq":198495,"id":"CVE-2026-62437","ts":1789392026200,"field":"severity","old":"none","new":"medium"},{"seq":196289,"id":"CVE-2026-62437","ts":1789383636704,"field":"cvss","old":"6.5","new":null},{"seq":196288,"id":"CVE-2026-62437","ts":1789383636704,"field":"severity","old":"medium","new":"none"},{"seq":195218,"id":"CVE-2026-62437","ts":1789380503808,"field":"cvss","old":null,"new":"6.5"},{"seq":195217,"id":"CVE-2026-62437","ts":1789380503808,"field":"severity","old":"none","new":"medium"},{"seq":194005,"id":"CVE-2026-62437","ts":1789378578952,"field":"cvss","old":"6.5","new":null},{"seq":194004,"id":"CVE-2026-62437","ts":1789378578952,"field":"severity","old":"medium","new":"none"},{"seq":192792,"id":"CVE-2026-62437","ts":1789376433925,"field":"cvss","old":null,"new":"6.5"},{"seq":192791,"id":"CVE-2026-62437","ts":1789376433925,"field":"severity","old":"none","new":"medium"},{"seq":191579,"id":"CVE-2026-62437","ts":1789373485257,"field":"cvss","old":"6.5","new":null},{"seq":191578,"id":"CVE-2026-62437","ts":1789373485257,"field":"severity","old":"medium","new":"none"},{"seq":190364,"id":"CVE-2026-62437","ts":1789369382198,"field":"cvss","old":null,"new":"6.5"},{"seq":190363,"id":"CVE-2026-62437","ts":1789369382198,"field":"severity","old":"none","new":"medium"},{"seq":189151,"id":"CVE-2026-62437","ts":1789368298664,"field":"cvss","old":"6.5","new":null},{"seq":189150,"id":"CVE-2026-62437","ts":1789368298664,"field":"severity","old":"medium","new":"none"},{"seq":187934,"id":"CVE-2026-62437","ts":1789365175427,"field":"cvss","old":null,"new":"6.5"},{"seq":187933,"id":"CVE-2026-62437","ts":1789365175427,"field":"severity","old":"none","new":"medium"},{"seq":186721,"id":"CVE-2026-62437","ts":1789363334316,"field":"cvss","old":"6.5","new":null},{"seq":186720,"id":"CVE-2026-62437","ts":1789363334316,"field":"severity","old":"medium","new":"none"},{"seq":185507,"id":"CVE-2026-62437","ts":1789361137581,"field":"cvss","old":null,"new":"6.5"},{"seq":185506,"id":"CVE-2026-62437","ts":1789361137581,"field":"severity","old":"none","new":"medium"},{"seq":184294,"id":"CVE-2026-62437","ts":1789358203488,"field":"cvss","old":"6.5","new":null},{"seq":184293,"id":"CVE-2026-62437","ts":1789358203488,"field":"severity","old":"medium","new":"none"},{"seq":182545,"id":"CVE-2026-62437","ts":1789354251204,"field":"cvss","old":null,"new":"6.5"},{"seq":182544,"id":"CVE-2026-62437","ts":1789354251204,"field":"severity","old":"none","new":"medium"},{"seq":181338,"id":"CVE-2026-62437","ts":1789353190154,"field":"cvss","old":"6.5","new":null},{"seq":181337,"id":"CVE-2026-62437","ts":1789353190154,"field":"severity","old":"medium","new":"none"},{"seq":180131,"id":"CVE-2026-62437","ts":1789350201707,"field":"cvss","old":null,"new":"6.5"},{"seq":180130,"id":"CVE-2026-62437","ts":1789350201707,"field":"severity","old":"none","new":"medium"},{"seq":178924,"id":"CVE-2026-62437","ts":1789348146236,"field":"cvss","old":"6.5","new":null},{"seq":178923,"id":"CVE-2026-62437","ts":1789348146236,"field":"severity","old":"medium","new":"none"},{"seq":177717,"id":"CVE-2026-62437","ts":1789346310105,"field":"cvss","old":null,"new":"6.5"},{"seq":177716,"id":"CVE-2026-62437","ts":1789346310105,"field":"severity","old":"none","new":"medium"},{"seq":176510,"id":"CVE-2026-62437","ts":1789343085452,"field":"cvss","old":"6.5","new":null},{"seq":176509,"id":"CVE-2026-62437","ts":1789343085452,"field":"severity","old":"medium","new":"none"},{"seq":174627,"id":"CVE-2026-62437","ts":1789334816642,"field":"cvss","old":null,"new":"6.5"},{"seq":174626,"id":"CVE-2026-62437","ts":1789334816642,"field":"severity","old":"none","new":"medium"},{"seq":173422,"id":"CVE-2026-62437","ts":1789333546029,"field":"cvss","old":"6.5","new":null},{"seq":173421,"id":"CVE-2026-62437","ts":1789333546029,"field":"severity","old":"medium","new":"none"},{"seq":172236,"id":"CVE-2026-62437","ts":1789331035288,"field":"cvss","old":null,"new":"6.5"},{"seq":172235,"id":"CVE-2026-62437","ts":1789331035288,"field":"severity","old":"none","new":"medium"},{"seq":171050,"id":"CVE-2026-62437","ts":1789328660995,"field":"cvss","old":"6.5","new":null},{"seq":171049,"id":"CVE-2026-62437","ts":1789328660995,"field":"severity","old":"medium","new":"none"},{"seq":169845,"id":"CVE-2026-62437","ts":1789327081530,"field":"cvss","old":null,"new":"6.5"},{"seq":169844,"id":"CVE-2026-62437","ts":1789327081530,"field":"severity","old":"none","new":"medium"}]}