Integer underflow in Xen - CVE-2026-102699
Published: October 13, 2026
Vulnerability identifier: #VU154194
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102699
CWE-ID: CWE-191
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service affecting the entire host.
The vulnerability exists due to integer underflow in GNTTABOP_cache_flush when calculating guest cache-flush operations. A local user can issue a cache-flush operation that triggers the underflow to cause a denial of service affecting the entire host.
Only Arm systems are vulnerable. On 64-bit Arm, the resulting loop can take excessively long and is likely to eventually crash the hypervisor.
Affected software
Xen
Debian Linux
xen (Debian package)
Debian Linux
xen (Debian package)
How to mitigate CVE-2026-102699
Install security update from vendor's website.
xen (Debian package) - update to 4.20.4+39-gf1e1321c87-0+deb13u1