xen: patch with XSA-495

Xen Security Advisory CVE-2026-42493 / XSA-495

                    x86 shadow paging is deprecated

Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly.  Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk.  Memory-wise
small enough guests may still be okay to run.

An unprivileged guest may be able to cause Denial of Service (DoS)
affecting the entire host.

https://xenbits.xen.org/xsa/advisory-495.html

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
(cherry picked from commit f30591491f)

pkgs/by-name/xe/xen/package.nix

@@ -324,6 +324,12 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-ns0s++J2adUD/HWuMiYad/g3MITs+twlMnkpFnP7T0w=";
     })
 
+    # XSA #495
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa495-4.20.patch";
+      hash = "sha256-SAMu8r0yyPvD3zLCaQL53oNs+ZhV3puKUq4cCofkut8=";
+    })
+
     # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21)
     (fetchpatch {
       url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";