Race condition in Xen - CVE-2026-79610

Vulnerability details

The vulnerability allows a local user to escalate privileges to those of the host, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a race condition in Xen's grant-table subsystem when changing grant table versions frees and reallocates status pages, leaving previously calculated status-array pointers stale. A local user can trigger concurrent grant table version changes from v2 to v1 and back to v2 to escalate privileges to those of the host, disclose sensitive information, or cause a denial of service.

Exploitation requires an x86 guest with multiple vCPUs that is permitted to use grant table version 2 interfaces, and a hypervisor built with grant table support enabled.

Affected software

How to mitigate CVE-2026-79610

External References

• https://xenbits.xen.org/xsa/advisory-517.html

Related Security Bulletins

• Multiple vulnerabilities in Xen
• Debian update for xen