Back Linuxsecurity

openSUSE 15.5 Xen DoS Grant Table Fix Advisory 2026-1657

Linuxsecurity •LinuxSecurity Advisories • April 29, 2026

## This update for xen fixes the following issues: * CVE-2025-54505: floating point divider state sampling on AMD CPUs AMD- SN-7053 (bsc#1262428). * CVE-2026-23557: Xenstored DoS via XS_RESET_WATCHES command (bsc#1262178). * CVE-2026-23558: grant table v2 race in status page mapping (bsc#1262180).

* bsc#1262178 * bsc#1262180 * bsc#1262428 Cross- * CVE-2025-54505 * CVE-2026-23557 * CVE-2026-23558 CVSS scores: * CVE-2025-54505 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N * CVE-2025-54505 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2025-54505 ( NVD ): 2.0 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-23557 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H * CVE-2026-23558 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-23558 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Affected Products: Read the Full Advisory

* CVE-2025-54505 ( SUSE ): 6.9

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

* CVE-2025-54505 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

* CVE-2025-54505 ( NVD ): 2.0

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

* CVE-2026-23557 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

* CVE-2026-23558 ( SUSE ): 7.3

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

* CVE-2026-23558 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Read the Full Advisory

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in openSUSE Xen Affecting Multiple Versions Recent updates for openSUSE have addressed multiple vulnerabilities in Xen, specifically CVE-2025-54505, CVE-2026-23557, and CVE-2026-23558. CVE-2025-54505 involves floating point divider state sampling on AMD CPUs, with a CVSS score of 6.9. CVE-2026-23557 allows for a denial of service (DoS) via the XS_RESET_WATCHES command, rated at 6.5. CVE-2026-23558 presents a race condition in grant table v2 status page mapping, with a higher severity score of 7.3. Affected systems include openSUSE Leap 15.3 and SUSE Linux Enterprise Micro 5.2. The vulnerabilities were disclosed recently, with CVE-2025-54505 published on April 27, 2026, and a proof of concept available since April 19, 2026. Users are urged to apply the latest patches to mitigate these risks. The vulnerabilities could potentially allow attackers to exploit systems running vulnerable versions of Xen. 2 sources 58

Extracted Entities

openSUSE 15.5 Xen DoS Grant Table Fix Advisory 2026-1657

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (3)

Platforms (1)