Buffer overflow in Xen - CVE-2026-79609

Vulnerability details

The vulnerability allows a local user to escalate privileges to those of the host, disclose information pertaining to other guests, or cause a denial of service affecting the entire host.

The vulnerability exists due to incomplete directmap coverage of guest memory in the x86 XPTI page-table copying mechanism when reading guest-chosen root page tables through the directmap. A local user can use a 64-bit PV guest with a root page table outside the directmap's coverage to escalate privileges to those of the host, disclose information pertaining to other guests, or cause a denial of service affecting the entire host.

Only x86 systems with RAM above the 5 TiB boundary, or the 3.5 TiB boundary when CONFIG_BIGMEM=y, are affected. HVM and PVH guests cannot leverage the vulnerability.

Affected software

How to mitigate CVE-2026-79609

External References

• https://xenbits.xen.org/xsa/advisory-516.html

Related Security Bulletins

• Multiple vulnerabilities in Xen
• Debian update for xen