Memory Management Vulnerability in Xen Project Products
CVE-2026-102700

Currently unrated

Key Information:

Vendor: Xen Project
Status: Xen Project
Vendor: CVE Published:; 13 October 2026

🔔 Create Xen Project Vulnerability Alert

What is CVE-2026-102700?

A memory management issue exists in the Xen Hypervisor where the GNTTAB_cache_flush function does not correctly handle the error path after a NULL pointer check is added. The failure to release page references for pages owned by special system domains, such as DOM_IO and DOM_COW, can lead to potential memory leaks or unintended behaviors. This vulnerability underscores the need for proper error handling in memory management within the hypervisor.

Affected Version(s)

Xen consult Xen advisory XSA-520

References

https://xenbits.xenproject.org/xsa/advisory-520.html

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 13, 2026
Vulnerability Reserved
Sep 29, 2026

Credit

This issue was discovered independently by Andrew Cooper of Citrix and Yehyeong Lee.

CVE-2026-102700 Data

JSON