Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2026-42488 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache.

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://xenbits.xenproject.org/xsa/advisory-494.html
• http://www.openwall.com/lists/oss-security/2026/06/09/14

Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2026-42488 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache.

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://xenbits.xenproject.org/xsa/advisory-494.html
• http://www.openwall.com/lists/oss-security/2026/06/09/14