Memory Handling Vulnerability in Xen Hypervisor for x86 PV Guests
CVE-2026-79603

4.3MEDIUM

Key Information:

Vendor

Xen Project
Status
Xen Project
Vendor
CVE Published:
8 September 2026

What is CVE-2026-79603?

The vulnerability allows x86 para-virtualized (PV) guests to free memory pages while a stale Translation Lookaside Buffer (TLB) entry still points to those pages. If the memory is scrubbed prior to the necessary TLB flush, it creates a potential window for the PV guest to alter a page that has already been cleared. This could result in unauthorized access or modification of data, posing a significant security risk. It is essential for users and administrators to apply any relevant patches or mitigations to safeguard their systems.

Affected Version(s)

Xen consult Xen advisory XSA-511

References

https://xenbits.xenproject.org/xsa/advisory-511.html

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Roger Pau Monné of AMD.
.