CVE-2022-26362

x86 pv: Race condition in typeref acquisition Xen maintains a type
reference count for pages, in addition to a regular reference count. This
scheme is used to maintain invariants required for Xen’s safety, e.g. PV
guests may not have direct writeable access to pagetables; updates need
auditing by Xen. Unfortunately, the logic for acquiring a type reference
has a race condition, whereby a safely TLB flush is issued too early and
creates a window where the guest can re-establish the read/write mapping
before writeability is prohibited.

Notes