CVE-2022-42309: Debian Linux

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Xen Xen: affected versions not specified

Published 2022-11-01. Last modified 2026-06-17.