From 62ffdca6be635a1f245d015b5f0a1bf109ce3289 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Mon, 7 Sep 2026 21:11:17 +1000 Subject: [PATCH 1/4] xen: patch with XSA-509 Xen Security Advisory CVE-2026-62437 / XSA-509 version 3 x86: DMs may cause mem leak by IRQ binding When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be. A HVM guest with one or more PCI devices assigned can cause a memory leak in the hypervisor, possibly leading to Denial of Service (DoS) of the entire host. https://xenbits.xenproject.org/xsa/advisory-509.html Signed-off-by: Fernando Rodrigues (cherry picked from commit f50448b6cde73a2e0d6af4fce37b2daf784eb247) --- pkgs/by-name/xe/xen/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index 6e47fa7230d9..1b593bef0f73 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -185,6 +185,11 @@ stdenv.mkDerivation (finalAttrs: { ./0001-makefile-efi-output-directory.patch (replaceVars ./0002-scripts-external-executable-calls.patch scriptDeps) + + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa509.patch"; + hash = "sha256-Ive95ewRsPe/Oq2NpqkcgXwKAi8pKJAF4eGQ9IkgM9A="; + }) ] ++ optionals (versionOlder finalAttrs.version "4.21") [ # Patch `libxl` to search for `qemu-system-i386` properly. From a82f84d45658e1891bfb0b3eee6636b5ec4999dd Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Mon, 7 Sep 2026 21:11:17 +1000 Subject: [PATCH 2/4] xen: patch with XSA-510 Xen Security Advisory CVE-2026-79602 / XSA-510 version 3 x86: improper handling of HVM emulation return codes A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen. Passing through a PCI device with at least one BAR in IO address space to unprivileged HVM guests can result in a Denial of Service (DoS) affecting the entire host. https://xenbits.xenproject.org/xsa/advisory-510.html Signed-off-by: Fernando Rodrigues (cherry picked from commit 79847978125038e35da258412e06a9ed3ddde56e) --- pkgs/by-name/xe/xen/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index 1b593bef0f73..d46efbb254b5 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -190,6 +190,11 @@ stdenv.mkDerivation (finalAttrs: { url = "https://xenbits.xenproject.org/xsa/xsa509.patch"; hash = "sha256-Ive95ewRsPe/Oq2NpqkcgXwKAi8pKJAF4eGQ9IkgM9A="; }) + + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa510.patch"; + hash = "sha256-RxCN2TMqeXVjHZhqxLvhWE40vUkD52RDYNyd9+6K9mA="; + }) ] ++ optionals (versionOlder finalAttrs.version "4.21") [ # Patch `libxl` to search for `qemu-system-i386` properly. From 681b10913fb6453b80b96bdd76c5d024b62af33f Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Mon, 7 Sep 2026 21:11:17 +1000 Subject: [PATCH 3/4] xen: patch with XSA-511 Xen Security Advisory CVE-2026-79603 / XSA-511 version 3 Unconditionally do TLB flushing ahead of page scrubbing x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page. Deployments using `xsm=silo scrub-domheap` with the aim of not allowing the exchange of information amongst guests are not effective in the presence of PV guests. https://xenbits.xenproject.org/xsa/advisory-511.html Not-cherry-picked-because: NixOS 26.05 ships with Xen 4.20, which requires the special xsa511-4.20.patch file. This is in contrast with unstable, which ships with Xen 4.22 and thus can use the regular patch. Signed-off-by: Fernando Rodrigues --- pkgs/by-name/xe/xen/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index d46efbb254b5..7e090379405b 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -195,6 +195,11 @@ stdenv.mkDerivation (finalAttrs: { url = "https://xenbits.xenproject.org/xsa/xsa510.patch"; hash = "sha256-RxCN2TMqeXVjHZhqxLvhWE40vUkD52RDYNyd9+6K9mA="; }) + + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa511-4.20.patch"; + hash = "sha256-rQTQ0UmDKo5Oi8THUHfb8W6/1OY2S3VEowmJf7Tb+1o="; + }) ] ++ optionals (versionOlder finalAttrs.version "4.21") [ # Patch `libxl` to search for `qemu-system-i386` properly. From e2bf3afa356ed22bbde816077ec92f016955b658 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Mon, 7 Sep 2026 21:11:17 +1000 Subject: [PATCH 4/4] xen: patch with XSA-512 Xen Security Advisory CVE-2026-79604 / XSA-512 version 3 oxenstored: Unbounded accumulation of watches Oxenstored maintains two datastructures about watches; one global trie, and one hashtable tracked per domain. When a xenbus reconnect is requested, watches are not cleared out of the global trie. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. This is the Xen oxenstored patch. https://xenbits.xenproject.org/xsa/advisory-512.html Signed-off-by: Fernando Rodrigues (cherry picked from commit a36b0d5d62e07851b4a9bd65d5f1617d11604593) --- pkgs/by-name/xe/xen/package.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index 7e090379405b..dbf92bb8e9ee 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -200,6 +200,15 @@ stdenv.mkDerivation (finalAttrs: { url = "https://xenbits.xenproject.org/xsa/xsa511-4.20.patch"; hash = "sha256-rQTQ0UmDKo5Oi8THUHfb8W6/1OY2S3VEowmJf7Tb+1o="; }) + + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa512-1.patch"; + hash = "sha256-Xky7ddRSd1d+Y/voEmsyiyMsU7NX/WM2/yOviaLv5gU="; + }) + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa512-2.patch"; + hash = "sha256-4LgqC1F22kFjiVWgiSb1hZazbBF2Fziiif0Scv+ynho="; + }) ] ++ optionals (versionOlder finalAttrs.version "4.21") [ # Patch `libxl` to search for `qemu-system-i386` properly.