CVE-2026-79607

Awaiting Analysis Awaiting Analysis - Queue

Xenstore Memory Corruption via Incomplete Watch State Update

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Xen Project

Description

During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-79607

EUVD

EUVD-2026-98823

Affected Vendors & Products

Vendor	Product	Version / Range
xen	xs_tools	*
xen	xen	From 4.22 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability, CVE-2026-79607, affects Xenstore in Xen 4.22. During a live update, the state record for a Xenstore watch with a specified depth is written with two missing bytes. This causes an inconsistent state when read back, leading to a crash of Xenstore or corrupted data.

Detection Guidance

Detection involves checking if your system runs Xen 4.22 with xenstore as a daemon or stubdom. Verify Xen version with 'xl info | grep xen_version' and check xenstore process with 'ps aux | grep xenstore'. Systems using oxenstored are not vulnerable.

Impact Analysis

The vulnerability can cause a denial-of-service (DoS) for host domain administration. Xenstore may crash or produce incorrect data, disrupting management functions. Systems using Xen 4.22 with xenstore as a daemon or stubdom are affected. Systems using oxenstored or older versions are not vulnerable.

Compliance Impact

This vulnerability primarily causes a denial-of-service (DoS) for host domain administration by crashing Xenstore or corrupting its data during a live update. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, a DoS could indirectly affect compliance by disrupting system availability, potentially violating service level agreements or operational requirements.

Mitigation Strategies

Apply the provided patch immediately. Alternatively, avoid live updates of Xenstore or switch to oxenstored if possible. Ensure no Xen 4.22 systems run xenstore as daemon or stubdom without mitigation.

Hi! I’m here to help you understand CVE-2026-79607. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70