From: Grygorii Strashko <grygorii_strashko@epam.com>
Subject: evtchn: evtchn_bind_virq() error path unconditionally calls domain_deinit_states()

There is a corner case in the error path of evtchn_bind_virq() (handling
EVTCHNOP_bind_virq hypercall) which allows unprivileged domains to
interfere with privileged ones: If an unprivileged domain allocates all
available ports to reach "no more ports available" and then issues an
EVTCHNOP_bind_virq hypercall to bind any allowed VIRQ (e.g. VIRQ_DEBUG),
domain_deinit_states() will be called despite not having called
domain_init_states().

To fix the issue move domain_deinit_states(d) under the same condition as
used for the domain_init_states() call.

This is CVE-2026-42492 / XSA-496.

Fixes: f94360a7fe9b ("xen: add bitmap to indicate per-domain state changes")
Signed-off-by: Grygorii Strashko <grygorii_strashko@epam.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>

--- a/xen/common/event_channel.c
+++ b/xen/common/event_channel.c
@@ -523,7 +523,8 @@ int evtchn_bind_virq(evtchn_bind_virq_t
     if ( rc < 0 )
     {
         gdprintk(XENLOG_WARNING, "EVTCHNOP failure: error %d\n", rc);
-        domain_deinit_states(d);
+        if ( virq == VIRQ_DOM_EXC )
+            domain_deinit_states(d);
         goto out;
     }