CVE-2026-72380

xen/pvcalls: bound backend response req_id before indexing rsp[]

References

Notes


      

Bugs

Status

Branch Status
upstream released (7.2-rc2) [d33846c8dcc06b83b7acdeac1e8bfbb5c0c26cb2]
7.2-upstream-stable N/A "Fixed before branching point"
7.1-upstream-stable released (7.1.5) [d1297a9e2fd6ce08678b370d41bc980ca798f809]
6.18-upstream-stable released (6.18.57) [bc8f2d1c6f7cf6e6551c00eb582baf4b52a04794]
6.12-upstream-stable released (6.12.114) [ede7a60b046d8b7288651c55198574ed7c259da7]
6.6-upstream-stable released (6.6.160) [72e27ef70a20298e60a1de438f3628c515dea895]
6.1-upstream-stable released (6.1.191) [4aaf7f32f1569e2c0475e073b8d7ec63b231d4c6]
5.10-upstream-stable needed
sid released (7.1.5-1)
6.12-trixie-security released (6.12.115-1)
6.1-bookworm-security needed
5.10-bullseye-security needed