Access Control Flaw in Xen Hypervisor
CVE-2026-102704

Currently unrated

Key Information:

Vendor

Xen Project
Status
Xen Project
Vendor
CVE Published:
4 November 2026

What is CVE-2026-102704?

The Xen Hypervisor contains an access control vulnerability that arises due to erroneous checks during Grant Copy operations on memory. Specifically, the issue occurs when permissions are improperly enforced for operations attempting to copy memory via frame numbers instead of grant references. This flaw may allow unauthorized access to memory not allocated to the caller, potentially leading to significant security implications. Proper access verification measures are critical to guarantee the integrity of memory operations within the hypervisor, and the vulnerability highlights the need for stringent checks to maintain a secure virtualization environment.

Affected Version(s)

Xen consult Xen advisory XSA-523

References

https://xenbits.xenproject.org/xsa/advisory-523.html

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Anthropic using Claude, then validated by Stephan Lipp of Ada Logics. It was then independently reported by the CodeAnt AI Security Research Team.
.