SB2026101340 - Multiple vulnerabilities in Xen

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101340

SB2026101340 - Multiple vulnerabilities in Xen

Published: October 13, 2026

Security Bulletin ID SB2026101340
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Encoding Error (CVE-ID: CVE-2026-79607)

CWE-ID: CWE-172 - Encoding Error

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to corrupt Xenstore data or cause a denial of service affecting host domain administration.

The vulnerability exists due to incomplete serialization of watch state records in Xenstore when transferring state during a live update. A local user can create a Xenstore watch with a specified watch depth from an unprivileged guest to corrupt Xenstore data or cause a denial of service affecting host domain administration.

Exploitation requires the C implementation of Xenstore to run as a daemon or stub domain.


2) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-79608)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information from other contexts on the same processor core.

The vulnerability exists due to an inverted conditional in Xen's Zenbleed workaround when determining whether the workaround needs to be applied. A local user can exploit the failure to apply the required workaround to disclose sensitive information from other contexts on the same processor core.

Exploitation is limited to systems using the AMD Zen2 microarchitecture with out-of-date microcode. Exposed data can include cryptographic key material, ciphertext and plaintext processed by AES-NI instructions, and data processed by REP-MOVS instructions.


3) Buffer overflow (CVE-ID: CVE-2026-79609)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges to those of the host, disclose information pertaining to other guests, or cause a denial of service affecting the entire host.

The vulnerability exists due to incomplete directmap coverage of guest memory in the x86 XPTI page-table copying mechanism when reading guest-chosen root page tables through the directmap. A local user can use a 64-bit PV guest with a root page table outside the directmap's coverage to escalate privileges to those of the host, disclose information pertaining to other guests, or cause a denial of service affecting the entire host.

Only x86 systems with RAM above the 5 TiB boundary, or the 3.5 TiB boundary when CONFIG_BIGMEM=y, are affected. HVM and PVH guests cannot leverage the vulnerability.


4) Race condition (CVE-ID: CVE-2026-79610)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges to those of the host, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a race condition in Xen's grant-table subsystem when changing grant table versions frees and reallocates status pages, leaving previously calculated status-array pointers stale. A local user can trigger concurrent grant table version changes from v2 to v1 and back to v2 to escalate privileges to those of the host, disclose sensitive information, or cause a denial of service.

Exploitation requires an x86 guest with multiple vCPUs that is permitted to use grant table version 2 interfaces, and a hypervisor built with grant table support enabled.


5) Improper handling of exceptional conditions (CVE-ID: CVE-2026-79611)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service in the guest.

The vulnerability exists due to improper handling of processor debug states in the VMX VM-entry state adjustment logic when branch tracing is enabled, debug exceptions are intercepted, single stepping is active, and blocking by STI or MOV SS is active. A local user can execute userspace code in an HVM or PVH guest that triggers this state combination to cause a denial of service in the guest.

Only systems supporting VMX hardware virtualization extensions on Intel, VIA, or Zhaoxin CPUs are affected.


6) Incorrect authorization (CVE-ID: CVE-2026-102702)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to corrupt memory belonging to another domain.

The vulnerability exists due to improper authorization in GNTTABOP_cache_flush when handling cache-flush operations on memory mapped from another domain through the grant table interface. A local user can issue an invalidate-without-clean operation against a read-only grant mapping to corrupt memory belonging to another domain.

Only Arm systems are vulnerable.


7) Integer underflow (CVE-ID: CVE-2026-102699)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service affecting the entire host.

The vulnerability exists due to integer underflow in GNTTABOP_cache_flush when calculating guest cache-flush operations. A local user can issue a cache-flush operation that triggers the underflow to cause a denial of service affecting the entire host.

Only Arm systems are vulnerable. On 64-bit Arm, the resulting loop can take excessively long and is likely to eventually crash the hypervisor.


8) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-102700)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to failure to release a page reference in the GNTTAB_cache_flush error path when handling a cache-flush operation for a page owned by a special system domain. A local user can invoke the operation for such a page to cause a denial of service.

Only x86 systems are vulnerable. The relevant system domains are DOM_IO and DOM_COW. The most likely outcome affects Domain 0, potentially affecting the entire host, or another domain.


9) Stack-based buffer overflow (CVE-ID: CVE-2026-102701)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to potentially execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in tap_ctl_connect_xenblkif() when negotiating multi-page rings between the frontend and backend. A local user can request a ring size exceeding the assumed limit of 8 to potentially execute arbitrary code.

Tapdisk normally runs as root.


Remediation

Install update from vendor's website.

References