Xen (vRTC): Out-of-bounds read in vRTC emulation - hypervisor memory disclosure to a guest

Impact

Out-of-bounds read in vRTC emulation - hypervisor memory disclosure to a guest

Who can reach it

Tenant VM guest

What to do

Hypervisor patch + reboot/evacuation

References

Related entries

• OpenSSL: crafted CMS message causes an 8-byte out-of-bounds heap write during CMS_decrypt()CVE-2026-63072 · OpenSSL CMS decryption (AES-WRAP-PAD key unwrap output buffer)High
• OpenSSL QUIC: a peer withholding acknowledgements makes ACK-only metadata accumulate for the connection's lifeCVE-2026-63075 · OpenSSL QUIC packet history (ACK-only packet metadata retention)High
• OpenSSL CMP: unchecked protectionAlg parameter type is dereferenced as a PBMParameter and crashes the processCVE-2026-63076 · OpenSSL CMP password-based MAC verification (protectionAlg parameter type check)High
• Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot): Slot 0 of the client's ISM device array isCVE-2026-64048 · Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot)High
• Linux kernel pcrypt: padata fallback leaves the parallel completion callback on the child requestCVE-2026-64312 · Linux kernel crypto pcrypt (padata -EBUSY fallback path)High
• Linux kernel RT scheduler: RT_PUSH_IPI can livelock a busy many-core node under softirq loadCVE-2026-64374 · Linux kernel RT scheduler (RT_PUSH_IPI pull logic on non-PREEMPT_RT kernels)High