CVE-2022-26357: Debian Linux

High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days.

race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Xen Xen: from 4.11.0, before 4.12.0 (fixed in 4.12.0); from 4.13.0, before 4.16.0 (fixed in 4.16.0)

Published 2022-04-05. Last modified 2026-06-17.