CVE-2026-102700
Awaiting Analysis Awaiting Analysis - Queue

Memory Leak in Xen Hypervisor via GNTTAB_cache_flush

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Xen Project

Description
With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOM_IO and DOM_COW are system domains which can have memory pages assigned to them.)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-19
AI Q&A
2026-10-13
EPSS Evaluated
2026-10-18
NVD
CVE-2026-102700
EUVD
EUVD-2026-98832

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xen xen From 4.5 (inc) to 4.20 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a page reference leak in the GNTTAB cache-flush handling mechanism of Xen. When a page owned by a special system domain (DOM_IO or DOM_COW) is processed, the error path fails to drop the page reference, leading to a resource leak.

Detection Guidance

Detection of this vulnerability requires checking the Xen version and applying the patch from XSA-520 advisory. No specific commands are provided in the resources for detection.

Impact Analysis

The vulnerability can cause a Denial of Service (DoS) affecting Domain 0 or other domains, particularly on x86 systems. This may result in system instability or crashes for users running affected Xen versions.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by failing to release page references in special system domains. It does not directly involve data breaches or unauthorized access, which are key concerns for GDPR or HIPAA. However, a DoS could disrupt systems handling sensitive data, potentially impacting compliance by degrading availability of critical services.

Mitigation Strategies

Apply the patch provided in XSA-520 advisory to resolve the issue. Affected versions are Xen 4.5 through 4.20. Versions 4.21 and newer, as well as 4.4 and older, are unaffected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart