Always-Incorrect Control Flow Implementation in Xen - CVE-2026-79608
Published: October 13, 2026
Vulnerability identifier: #VU154199
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-79608
CWE-ID: CWE-670
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information from other contexts on the same processor core.
The vulnerability exists due to an inverted conditional in Xen's Zenbleed workaround when determining whether the workaround needs to be applied. A local user can exploit the failure to apply the required workaround to disclose sensitive information from other contexts on the same processor core.
Exploitation is limited to systems using the AMD Zen2 microarchitecture with out-of-date microcode. Exposed data can include cryptographic key material, ciphertext and plaintext processed by AES-NI instructions, and data processed by REP-MOVS instructions.
Affected software
Xen
Debian Linux
xen (Debian package)
Debian Linux
xen (Debian package)
How to mitigate CVE-2026-79608
Install security update from vendor's website.
xen (Debian package) - update to 4.20.4+39-gf1e1321c87-0+deb13u1