CVE-2026-62430 describes a concurrency issue in Xen's handling of CMOS memory access. Xen caches the guest-chosen index for indirect IO port access, but one usage path lacks the necessary locking to prevent concurrent modifications. Consequently, a guest VM can alter the index after validation, causing an out-of-bounds read from an array. This vulnerability is categorized under CWE-362 (Race Condition) and has a CVSS 3.1 vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact.

An attacker controlling a guest VM could exploit this race condition to read out-of-bounds memory contents, potentially exposing sensitive information from the host or other guests. The vulnerability does not affect integrity or availability but has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting untrusted guest VM access or applying any recommended workarounds from the vendor.