CVE-2026-102702
Awaiting Analysis Awaiting Analysis - Queue

Cache Flush Underflow in Xen Hypervisor

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Xen Project

Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-19
AI Q&A
2026-10-13
EPSS Evaluated
2026-10-18
NVD
CVE-2026-102702
EUVD
EUVD-2026-98831

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xen xen *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-102702 involves a flaw in the GNTTABOP_cache_flush operation in Xen versions 4.5 and later. It allows unprivileged guests to corrupt memory belonging to another domain by using invalidate-without-clean on read-only grant mappings. This can lead to memory corruption if exploited.

Detection Guidance

Detecting this vulnerability requires checking if your Xen hypervisor is running a vulnerable version (4.5 or later) and if the GNTTABOP_cache_flush operation is enabled. Inspect Xen logs for hypervisor crashes or unusual loops during cache flush operations. Use system commands like 'xl info' to check Xen version and 'dmesg' for kernel logs indicating crashes or hangs.

Impact Analysis

A malicious unprivileged guest could exploit this flaw to crash the hypervisor, causing a Denial of Service. It may also lead to memory corruption, potentially enabling privilege escalation or information leaks.

Compliance Impact

This vulnerability primarily impacts system availability and integrity by allowing unprivileged guests to crash the hypervisor or corrupt memory. While not directly tied to GDPR or HIPAA, such vulnerabilities could lead to unauthorized data access or service disruptions, potentially violating compliance requirements for data protection and system reliability.

Mitigation Strategies

Apply available patches for Xen versions 4.5 and later. Update to the latest stable release of Xen. Restrict unprivileged guest access to GNTTABOP_cache_flush operations. Monitor hypervisor performance for signs of excessive loops or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart