CVE-2026-62437CWE-362

CVE-2026-62437

Medium · published September 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
0.6
In the wild
Unconfirmed
What it is

When guests are terminated, various pieces of cleanup need carrying out.

The cleaning up of PCI devices which were assigned to guests, and the

associated removal of tracking structures for IRQs used by the devices

occurs relatively early in the process. Unfortunately after that point

the guest about to be terminated could cause its device model (DM) to

re-establish such tracking structures, by having it bind one or more IRQs

anew. While some of those tracking structures would still be cleaned up

later on, at least one would not be.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00095 · 0.6th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-09-08T17:17Z
References (3)
EPSS history
Timeline
  • 10 SEP 03:17Z
    EPSS moved — → 0%
    epss
  • 08 SEP 12:10Z
    x86: DMs may cause mem leak by IRQ binding
    cvelistv5