Memory Corruption Issue in Xen Project's Grant Table Interface
CVE-2026-102702

7.5HIGH

Key Information:

Vendor

Xen Project
Status
Xen Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-102702?

This vulnerability in the Xen Hypervisor's grant table interface allows improper handling of memory mappings, leading to potential memory corruption. Specifically, the issue arises from the lack of restrictions against using invalidate-without-clean on read-only grant mappings. This could corrupt the granted memory, affecting the stability and reliability of the hypervisor and possibly allowing unauthorized access to sensitive data across virtual machines. This scenario underscores the need for stringent controls and potential updates to mitigate risks associated with memory handling in virtualized environments.

Affected Version(s)

Xen consult Xen advisory XSA-519

References

https://xenbits.xenproject.org/xsa/advisory-519.html

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CVE-2026-102699 was discovered by Leonid Komarianskyi of EPAM. It was later independently reported by Ayan Kumar Halder of AMD. CVE-2026-102702 was found by the security team while looking at the surrounding code.
.