Debian Linux - xen - None

Ubuntu Linux - oxenstored: Unbounded accumulation of watches: Oxenstored maintains two datastructures about watches; one global trie, and one hashtable tracked per domain. When a xenbus reconnect is requested, watches are not cleared out of the global trie. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. All version of Xen from 4.6 onwards are vulnerable. Only systems using the Ocaml Xenstored implementation are vulnerable. Systems using the C Xenstored implementation are not vulnerable.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6571 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6571-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 18, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : xen     CVE ID         : CVE-2026-62437 CVE-2026-79602 CVE-2026-79603 CVE-2026-79604                      CVE-2026-79608 CVE-2026-79609 CVE-2026-79610 CVE-2026-79611                      CVE-2026-102699 CVE-2026-102700 CVE-2026-102702

    Multiple vulnerabilities have been discovered in the Xen hypervisor,     which could result in privilege escalation, information disclosure or     denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 4.20.4+39-gf1e1321c87-0+deb13u1.

    We recommend that you upgrade your xen packages.

    For the detailed security status of xen please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/xen

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1d448c1d40 advisory.

    x86: DMs may cause mem leak by IRQ binding [XSA-509, CVE-2026-62437]     x86: improper handling of HVM emulation return codes     [XSA-510, CVE-2026-79602]     Unconditionally do TLB flushing ahead of page scrubbing [XSA-511,     CVE-2026-79603]     oxenstored: Unbounded accumulation of watches [XSA-512, CVE-2026-79604]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a9ea805bc1 advisory.

    x86: DMs may cause mem leak by IRQ binding [XSA-509, CVE-2026-62437]     x86: improper handling of HVM emulation return codes     [XSA-510, CVE-2026-79602]     Unconditionally do TLB flushing ahead of page scrubbing [XSA-511,     CVE-2026-79603]     oxenstored: Unbounded accumulation of watches [XSA-512, CVE-2026-79604]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - x86: DMs may cause mem leak by IRQ binding [XSA-509, CVE-2026-62437] x86: improper handling of HVM     emulation return codes [XSA-510, CVE-2026-79602] Unconditionally do TLB flushing ahead of page scrubbing     [XSA-511, CVE-2026-79603] oxenstored: Unbounded accumulation of watches [XSA-512, CVE-2026-79604]     (CVE-2026-79604)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366977	Debian dsa-6571 : libxen-dev - security update	Nessus	Debian Local Security Checks	Local	critical
362843	Fedora 44 : xen (2026-1d448c1d40)	Nessus	Fedora Local Security Checks	Local	high
362830	Fedora 43 : xen (2026-a9ea805bc1)	Nessus	Fedora Local Security Checks	Local	high
343914	Linux Distros Unpatched Vulnerability : CVE-2026-79604	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-79604

medium

Tenable Plugins

critical

high

high

medium