Improper handling of exceptional conditions in Xen - CVE-2026-79611
Published: October 13, 2026
Vulnerability identifier: #VU154196
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-79611
CWE-ID: CWE-755
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service in the guest.
The vulnerability exists due to improper handling of processor debug states in the VMX VM-entry state adjustment logic when branch tracing is enabled, debug exceptions are intercepted, single stepping is active, and blocking by STI or MOV SS is active. A local user can execute userspace code in an HVM or PVH guest that triggers this state combination to cause a denial of service in the guest.
Only systems supporting VMX hardware virtualization extensions on Intel, VIA, or Zhaoxin CPUs are affected.
Affected software
Xen
Debian Linux
xen (Debian package)
Debian Linux
xen (Debian package)
How to mitigate CVE-2026-79611
Install security update from vendor's website.
xen (Debian package) - update to 4.20.4+39-gf1e1321c87-0+deb13u1