* Xen Security Advisory 495 v2 (CVE-2026-42493) - x86 shadow paging is deprecated
@ 2026-07-28 12:04 Xen.org security team
0 siblings, 0 replies; only message in thread
From: Xen.org security team @ 2026-07-28 12:04 UTC (permalink / raw)
To: xen-announce, xen-devel, xen-users, oss-security; +Cc: Xen.org security team
[-- Attachment #1: Type: text/plain, Size: 4232 bytes --]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Xen Security Advisory CVE-2026-42493 / XSA-495
version 2
x86 shadow paging is deprecated
UPDATES IN VERSION 2
====================
Updated the patch for staging with further CI adjustements.
Public release.
ISSUE DESCRIPTION
=================
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
IMPACT
======
An unprivileged guest may be able to cause Denial of Service (DoS)
affecting the entire host.
VULNERABLE SYSTEMS
==================
All x86 systems with builds of Xen having SHADOW_PAGING=y are affected.
Note that prior to Xen 4.7 this control didn't exist, and all builds of
Xen would be affected. (Strictly speaking Xen 4.6 had a different, harder
to use mechanism to disable shadow paging support: One could pass
"shadow-paging=n" on the make command line.)
MITIGATION
==========
Running HVM and PVH in Hardware Assisted Paging (HAP) mode will avoid this
vulnerability.
There's no mitigation available for PV guests. This is because shadow
mode, if support is enabled in the hypervisor, could be engaged at any
time. Note that without shadow mode built into Xen, guests not properly
dealing with L1TF will simply be crashed instead.
RESOLUTION
==========
Applying the appropriate attached patch documents this issue.
Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.
xsa495.patch xen-unstable - Xen 4.22.0
xsa495-4.21.patch Xen 4.21.x
xsa495-4.20.patch Xen 4.20.x - Xen 4.19.x
xsa495-4.18.patch Xen 4.18.x
xsa495-4.17.patch Xen 4.17.x
$ sha256sum xsa495*
949624ce241ddc455c43cdde0ff045cc5fdf29b69f06f7079fa8f1d2400e1d9d xsa495.patch
bb1fea4b49840b81a1a7ca86124e308f23edd6eb078857d44d9ebaf1b352b374 xsa495-4.17.patch
06f2c862df85a17b9dc1d4a0df42cadb97e24b7033c070c9ad74ad72d278af0e xsa495-4.18.patch
bffa5816be9ddf0fabec0509f2b74e30a5dd0e5429a3b7919e304150cb5091f2 xsa495-4.20.patch
7092cf37dbcfecc9aa6bf9a2836ed70f48f52bccb9630e94c89d2afe120b47f5 xsa495-4.21.patch
$
DEPLOYMENT DURING EMBARGO
=========================
Deployment of patches or mitigations is NOT permitted (except where
all the affected systems and VMs are administered and used only by
organisations which are members of the Xen Project Security Issues
Predisclosure List). Specifically, deployment on public cloud systems
is NOT permitted.
This is because switching HVM or PVH guests from shadow to HAP mode is a
guest noticeable change, while for PV guests the lack of shadow mode is
noticeable because they then cannot be migrated anymore, and guests not
properly fixed for L1TF would be forcibly crashed.
Deployment is permitted only AFTER the embargo ends.
(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable. This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomqUMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZH9wH/2EYJsV5YVdJsoQSlG94dqOR7IDPEI2I17wUVSoG
OK6BaqaejA1SHJbt0/wSkhJ9er+1UHzgr61S7EnE813mugu7T9nwTku1/++4DB9O
V/ID/NZzWwGJ2EjCHGrVTPZvmxMmVBGZs3bex00xrQ83y97D3TfmCRH0k6ip7sUh
kKSmdvTdlnODuV1+3KT09RIpDvOjVGXLpnd22++0CcT0eFoOrn0nH2dgdUw/grTf
7ye6pGcj2xViznw7FDJnXG4XOAC+wIBMX9HJK6rMOFR9P2DFUxUEcYVN+DlzR67h
3Mejc9U4Ll+65RoZbI01lmpnpqEJ33kPRGkwzA0CJmkF8wQ=
=evRY
-----END PGP SIGNATURE-----
[-- Attachment #2: xsa495.patch --]
[-- Type: application/octet-stream, Size: 3705 bytes --]
From: Jan Beulich <jbeulich@suse.com>
Subject: x86: SHADOW_PAGING is deprecated
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed.
This is CVE-2026-42493 / XSA-495.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
diff --git a/SUPPORT.md b/SUPPORT.md
index 021264908cbc..55f2b0d102a7 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -366,6 +366,16 @@ This is typically done by a guest kernel agent known as a "balloon driver".
Status: Supported
+### Shadow paging
+
+Allows fully virtualized guests (HVM / PVH) to be run without (host side) page
+translation support by hardware (AMD: NPT, Intel: EPT).
+
+It is also required to migrate PV guests, and to allow L1TF-vulnerable guests
+to continue to run without compromising host security.
+
+ Status: Supported, not security supported
+
### Populate-on-demand memory
This is a mechanism that allows normal operating systems with only a balloon driver
@@ -498,7 +508,7 @@ This feature is independent
of the ARM "page granularity" feature (see below).
Status, x86 HVM/PVH, HAP: Supported
- Status, x86 HVM/PVH, Shadow, 2MiB: Supported
+ Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported
Status, ARM: Supported
On x86 in shadow mode, only 2MiB (L2) superpages are available;
diff --git a/automation/gitlab-ci/analyze.yaml b/automation/gitlab-ci/analyze.yaml
index 3f7532ee1d25..c650ed61c4d1 100644
--- a/automation/gitlab-ci/analyze.yaml
+++ b/automation/gitlab-ci/analyze.yaml
@@ -59,6 +59,7 @@ eclair-x86_64-allcode:
CONFIG_PERF_ARRAYS=y
CONFIG_PERF_COUNTERS=y
CONFIG_PV32=y
+ CONFIG_SHADOW_PAGING=y
CONFIG_UNSUPPORTED=y
CONFIG_XEN_GUEST=y
CONFIG_XHCI=y
@@ -91,7 +92,6 @@ eclair-x86_64-amd:
CONFIG_PV=n
CONFIG_XEN_IBT=n
CONFIG_XEN_SHSTK=n
- CONFIG_SHADOW_PAGING=n
CONFIG_HVM_FEP=n
CONFIG_TBOOT=n
CONFIG_HYPFS=n
diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
index d5929e34ecaa..27eefec5f9a5 100644
--- a/automation/gitlab-ci/build.yaml
+++ b/automation/gitlab-ci/build.yaml
@@ -296,12 +296,16 @@ debian-13-x86_64-gcc-debug:
<<: *build-test
variables:
CONTAINER: debian:13-x86_64
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
debian-13-x86_64-clang-debug:
extends: .clang-x86_64-build-debug
<<: *build-test
variables:
CONTAINER: debian:13-x86_64
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
debian-13-ppc64le-gcc-debug:
extends: .gcc-ppc64le-cross-build-debug
diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
index 2ce4747f6ea7..3ce0774b8d76 100644
--- a/xen/arch/x86/Kconfig
+++ b/xen/arch/x86/Kconfig
@@ -145,7 +145,6 @@ config XEN_IBT
config SHADOW_PAGING
bool "Shadow Paging"
- default !PV_SHIM_EXCLUSIVE
depends on PV || HVM
help
Shadow paging is a software alternative to hardware paging support
@@ -160,6 +159,9 @@ config SHADOW_PAGING
Under a small number of specific workloads, shadow paging may be
deliberately used as a performance optimisation.
+ NOTE: This feature is now deprecated. It is in particular no longer
+ security supported.
+
config PAGING
def_bool HVM || SHADOW_PAGING
[-- Attachment #3: xsa495-4.17.patch --]
[-- Type: application/octet-stream, Size: 3105 bytes --]
From: Jan Beulich <jbeulich@suse.com>
Subject: x86: SHADOW_PAGING is deprecated
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed.
This is CVE-2026-42493 / XSA-495.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
diff --git a/SUPPORT.md b/SUPPORT.md
index a55910fccecd..b040f95242a9 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -286,6 +286,16 @@ This is typically done by a guest kernel agent known as a "balloon driver".
Status: Supported
+### Shadow paging
+
+Allows fully virtualized guests (HVM / PVH) to be run without (host side) page
+translation support by hardware (AMD: NPT, Intel: EPT).
+
+It is also required to migrate PV guests, and to allow L1TF-vulnerable guests
+to continue to run without compromising host security.
+
+ Status: Supported, not security supported
+
### Populate-on-demand memory
This is a mechanism that allows normal operating systems with only a balloon driver
@@ -411,7 +421,7 @@ This feature is independent
of the ARM "page granularity" feature (see below).
Status, x86 HVM/PVH, HAP: Supported
- Status, x86 HVM/PVH, Shadow, 2MiB: Supported
+ Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported
Status, ARM: Supported
On x86 in shadow mode, only 2MiB (L2) superpages are available;
diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
index 1b27e5c01b75..34490488d084 100644
--- a/automation/gitlab-ci/build.yaml
+++ b/automation/gitlab-ci/build.yaml
@@ -238,6 +238,8 @@ debian-stretch-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: debian:stretch
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
debian-stretch-32-clang-debug:
extends: .clang-x86-32-build-debug
@@ -266,6 +268,8 @@ debian-bookworm-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: debian:bookworm
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
debian-bookworm-gcc:
extends: .gcc-x86-64-build
diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
index 370558756f0d..f4e38588c6de 100644
--- a/xen/arch/x86/Kconfig
+++ b/xen/arch/x86/Kconfig
@@ -151,7 +151,6 @@ config XEN_IBT
config SHADOW_PAGING
bool "Shadow Paging"
- default !PV_SHIM_EXCLUSIVE
depends on PV || HVM
---help---
@@ -167,7 +166,8 @@ config SHADOW_PAGING
Under a small number of specific workloads, shadow paging may be
deliberately used as a performance optimisation.
- If unsure, say Y.
+ NOTE: This feature is now deprecated. It is in particular no longer
+ security supported.
config BIGMEM
bool "big memory support"
[-- Attachment #4: xsa495-4.18.patch --]
[-- Type: application/octet-stream, Size: 2989 bytes --]
From: Jan Beulich <jbeulich@suse.com>
Subject: x86: SHADOW_PAGING is deprecated
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed.
This is CVE-2026-42493 / XSA-495.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
diff --git a/SUPPORT.md b/SUPPORT.md
index 27209cab7d4f..39e550e7a30e 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -315,6 +315,16 @@ This is typically done by a guest kernel agent known as a "balloon driver".
Status: Supported
+### Shadow paging
+
+Allows fully virtualized guests (HVM / PVH) to be run without (host side) page
+translation support by hardware (AMD: NPT, Intel: EPT).
+
+It is also required to migrate PV guests, and to allow L1TF-vulnerable guests
+to continue to run without compromising host security.
+
+ Status: Supported, not security supported
+
### Populate-on-demand memory
This is a mechanism that allows normal operating systems with only a balloon driver
@@ -440,7 +450,7 @@ This feature is independent
of the ARM "page granularity" feature (see below).
Status, x86 HVM/PVH, HAP: Supported
- Status, x86 HVM/PVH, Shadow, 2MiB: Supported
+ Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported
Status, ARM: Supported
On x86 in shadow mode, only 2MiB (L2) superpages are available;
diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
index 201acbbffd60..f22f149fe7e2 100644
--- a/automation/gitlab-ci/build.yaml
+++ b/automation/gitlab-ci/build.yaml
@@ -363,11 +363,15 @@ debian-stretch-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: debian:stretch
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
debian-bookworm-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: debian:bookworm
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
# Arm32 cross-build
diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
index 9611b8076197..fb91ee4fa9d7 100644
--- a/xen/arch/x86/Kconfig
+++ b/xen/arch/x86/Kconfig
@@ -151,7 +151,6 @@ config XEN_IBT
config SHADOW_PAGING
bool "Shadow Paging"
- default !PV_SHIM_EXCLUSIVE
depends on PV || HVM
---help---
@@ -167,7 +166,8 @@ config SHADOW_PAGING
Under a small number of specific workloads, shadow paging may be
deliberately used as a performance optimisation.
- If unsure, say Y.
+ NOTE: This feature is now deprecated. It is in particular no longer
+ security supported.
config BIGMEM
bool "big memory support"
[-- Attachment #5: xsa495-4.20.patch --]
[-- Type: application/octet-stream, Size: 3039 bytes --]
From: Jan Beulich <jbeulich@suse.com>
Subject: x86: SHADOW_PAGING is deprecated
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed.
This is CVE-2026-42493 / XSA-495.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
diff --git a/SUPPORT.md b/SUPPORT.md
index 67be5a5783d7..7db7ce9c3e37 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -353,6 +353,16 @@ This is typically done by a guest kernel agent known as a "balloon driver".
Status: Supported
+### Shadow paging
+
+Allows fully virtualized guests (HVM / PVH) to be run without (host side) page
+translation support by hardware (AMD: NPT, Intel: EPT).
+
+It is also required to migrate PV guests, and to allow L1TF-vulnerable guests
+to continue to run without compromising host security.
+
+ Status: Supported, not security supported
+
### Populate-on-demand memory
This is a mechanism that allows normal operating systems with only a balloon driver
@@ -485,7 +495,7 @@ This feature is independent
of the ARM "page granularity" feature (see below).
Status, x86 HVM/PVH, HAP: Supported
- Status, x86 HVM/PVH, Shadow, 2MiB: Supported
+ Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported
Status, ARM: Supported
On x86 in shadow mode, only 2MiB (L2) superpages are available;
diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
index 5f0acda942ac..9309e10ebba0 100644
--- a/automation/gitlab-ci/build.yaml
+++ b/automation/gitlab-ci/build.yaml
@@ -312,11 +312,15 @@ debian-12-x86_64-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: debian:12-x86_64
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
debian-12-x86_64-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: debian:12-x86_64
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
debian-12-ppc64le-gcc-debug:
extends: .gcc-ppc64le-cross-build-debug
diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
index 96fd1c3272d1..f63c55c783fc 100644
--- a/xen/arch/x86/Kconfig
+++ b/xen/arch/x86/Kconfig
@@ -177,7 +177,6 @@ config XEN_IBT
config SHADOW_PAGING
bool "Shadow Paging"
- default !PV_SHIM_EXCLUSIVE
depends on PV || HVM
help
@@ -193,7 +192,8 @@ config SHADOW_PAGING
Under a small number of specific workloads, shadow paging may be
deliberately used as a performance optimisation.
- If unsure, say Y.
+ NOTE: This feature is now deprecated. It is in particular no longer
+ security supported.
config BIGMEM
bool "big memory support"
[-- Attachment #6: xsa495-4.21.patch --]
[-- Type: application/octet-stream, Size: 3043 bytes --]
From: Jan Beulich <jbeulich@suse.com>
Subject: x86: SHADOW_PAGING is deprecated
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed.
This is CVE-2026-42493 / XSA-495.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
diff --git a/SUPPORT.md b/SUPPORT.md
index 4ba562eaf062..fa20ad629c26 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -366,6 +366,16 @@ This is typically done by a guest kernel agent known as a "balloon driver".
Status: Supported
+### Shadow paging
+
+Allows fully virtualized guests (HVM / PVH) to be run without (host side) page
+translation support by hardware (AMD: NPT, Intel: EPT).
+
+It is also required to migrate PV guests, and to allow L1TF-vulnerable guests
+to continue to run without compromising host security.
+
+ Status: Supported, not security supported
+
### Populate-on-demand memory
This is a mechanism that allows normal operating systems with only a balloon driver
@@ -498,7 +508,7 @@ This feature is independent
of the ARM "page granularity" feature (see below).
Status, x86 HVM/PVH, HAP: Supported
- Status, x86 HVM/PVH, Shadow, 2MiB: Supported
+ Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported
Status, ARM: Supported
On x86 in shadow mode, only 2MiB (L2) superpages are available;
diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
index 4cb52fe59715..51105ebbe99c 100644
--- a/automation/gitlab-ci/build.yaml
+++ b/automation/gitlab-ci/build.yaml
@@ -313,11 +313,15 @@ debian-13-x86_64-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: debian:13-x86_64
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
debian-13-x86_64-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: debian:13-x86_64
+ EXTRA_XEN_CONFIG: |
+ CONFIG_SHADOW_PAGING=y
debian-13-ppc64le-gcc-debug:
extends: .gcc-ppc64le-cross-build-debug
diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
index 3f0f3a0f3a77..06bf9269768b 100644
--- a/xen/arch/x86/Kconfig
+++ b/xen/arch/x86/Kconfig
@@ -144,7 +144,6 @@ config XEN_IBT
config SHADOW_PAGING
bool "Shadow Paging"
- default !PV_SHIM_EXCLUSIVE
depends on PV || HVM
help
@@ -160,7 +159,8 @@ config SHADOW_PAGING
Under a small number of specific workloads, shadow paging may be
deliberately used as a performance optimisation.
- If unsure, say Y.
+ NOTE: This feature is now deprecated. It is in particular no longer
+ security supported.
config PAGING
def_bool HVM || SHADOW_PAGING
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-28 12:05 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-28 12:04 Xen Security Advisory 495 v2 (CVE-2026-42493) - x86 shadow paging is deprecated Xen.org security team
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.