Xenstore Live Update Vulnerability in Xen Project
CVE-2026-79607

5.5MEDIUM

Key Information:

Vendor

Xen Project
Status
Xen Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-79607?

The vulnerability in Xenstore arises during live updates, where a specified watch depth results in the writing of an incomplete state record—specifically, two bytes are omitted. This leads to discrepancies when the state is retrieved from the new Xenstore, creating potential crashes or the retrieval of incorrect data, posing risks to system stability and reliability.

Affected Version(s)

Xen consult Xen advisory XSA-514

References

https://xenbits.xenproject.org/xsa/advisory-514.html

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Andrii Sultanov of Vates.
.