CVE-2024-31142: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 17.4% chance of exploitation in the next 30 days.

Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted. For more details, see: https://xenbits.xen.org/xsa/advisory-407.html https://xenbits.xen.org/xsa/advisory-434.html

Affected products

• Fedoraproject Fedora: version 38 only; version 40 only
• Xen Xen: before 4.15.6 (fixed in 4.15.6); from 4.16.0, before 4.16.6 (fixed in 4.16.6); from 4.17.0, before 4.17.4 (fixed in 4.17.4); from 4.18.0, before 4.18.2 (fixed in 4.18.2)

Published 2024-05-16. Last modified 2026-06-17.