Identify the kernel that serves guest devices
The Linux kernel maintainers shipped fixes on November 6 for three flaws in the drivers that provide virtual network and disk devices to Xen guests. The upstream changelogs for Linux 7.3.3 and 6.18.62 each list fixes for Xen advisories XSA-526, XSA-527 and XSA-528. Two fixes concern the network backend. The third concerns the block storage backend.
The Xen security team says a guest can cause the affected drivers to access memory that has already been freed. A crash in the backend can interrupt the host and other workloads on it. Xen also says information disclosure is possible and assesses privilege escalation as a low-likelihood outcome for the multicast flaw. CGH did not reproduce the issues or assess whether any deployment was attacked.
Verify the vendor fix and the running kernel
The relevant inventory is the Linux system that runs the affected backend. A version check inside a guest alone does not establish whether that backend has been fixed. For hosts on a distribution kernel, the distribution’s advisory and package history can identify a fix even when its version number differs from the upstream release. For managed infrastructure, the provider controls host patch timing.
The upstream fixes are available through the public Linux kernel archive. They carry no separate upstream purchase price or country rollout. CGH’s assessment is to record both the vendor-confirmed patch status and the kernel running after the maintenance window, since installing an updated package does not by itself establish that the host is running it.