Use-after-free in Xen - CVE-2026-23554
Published: March 18, 2026
Vulnerability details
The vulnerability allows a local user to escalate privileges, cause a denial of service, and leak information.
The vulnerability exists due to a use after free in the Intel EPT paging structures when modifying page mappings under the p2m lock. A local user on the guest OS can trigger the premature release of paging structures before cached EPT state is flushed, leading to stale entries in the cache that reference freed memory. This can result in access to unintended memory regions of the hypervisor.
The vulnerability affects x86 Intel systems with EPT support running Xen 4.17 or later. Only x86 HVM/PVH guests using HAP are able to leverage the vulnerability. Exploitation does not require additional privileges beyond those of a normal guest user, but access to a guest VM is required.
Affected software
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
Basesystem Module
Server Applications Module
openSUSE Leap
Fedora
Citrix XenServer
xen-libs-64bit
xen-libs-64bit-debuginfo
xen-tools-xendomains-wait-disk
xen-tools
xen
xen-tools-debuginfo
xen-doc-html
xen-libs-32bit-debuginfo
xen-libs-32bit
xen-tools-domU
xen-libs
xen-tools-domU-debuginfo
xen-libs-debuginfo
xen-debugsource
xen-devel
How to mitigate CVE-2026-23554
xen-libs-64bit-debuginfo - update to 4.17.6_06-150500.3.62.2
xen-tools-xendomains-wait-disk - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen-tools - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen-tools-debuginfo - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen-doc-html - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1
xen-libs-32bit-debuginfo - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1
xen-libs-32bit - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1
xen-tools-domU - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen-libs - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen-tools-domU-debuginfo - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen-libs-debuginfo - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen-debugsource - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen-devel - addressed in versions 4.17.6_06-150500.3.62.2, 4.18.5_12-150600.3.40.1, 4.20.2_08-150700.3.28.1
xen - addressed in versions 4.19.5-1.fc42, 4.20.2-4.fc43, 4.21.0-5.fc44, 4.21.1-1.fc44