Memory Management Vulnerability in Xen Project Products
CVE-2026-102700

4.7MEDIUM

Key Information:

Vendor

Xen Project
Status
Xen Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-102700?

A memory management issue exists in the Xen Hypervisor where the GNTTAB_cache_flush function does not correctly handle the error path after a NULL pointer check is added. The failure to release page references for pages owned by special system domains, such as DOM_IO and DOM_COW, can lead to potential memory leaks or unintended behaviors. This vulnerability underscores the need for proper error handling in memory management within the hypervisor.

Affected Version(s)

Xen consult Xen advisory XSA-520

References

https://xenbits.xenproject.org/xsa/advisory-520.html

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered independently by Andrew Cooper of Citrix and Yehyeong Lee.
.