Race Condition Vulnerability in Xen Project's Hypervisor Software
CVE-2026-79610

8.8HIGH

Key Information:

Vendor

Xen Project
Status
Xen Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-79610?

This vulnerability in the Xen Hypervisor arises from a race condition during transitions between different grant table versions, specifically when changing from v1 to v2 and back. The process can lead to the unintended release and reallocation of status pages, resulting in potentially incorrect pointers that reference outdated memory locations. This flaw can be exploited, leading to instability and unauthorized access to sensitive information within the hypervisor.

Affected Version(s)

Xen consult Xen advisory XSA-517

References

https://xenbits.xenproject.org/xsa/advisory-517.html

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Claude Opus and diagnosed as a security issue by Teddy Astie of Vates.
.