CVE-2026-79609
Awaiting Analysis Awaiting Analysis - Queue

XPTI Bypass via Directmap Access in Xen Hypervisor

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Xen Project

Description
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-19
AI Q&A
2026-10-13
EPSS Evaluated
2026-10-18
NVD
CVE-2026-79609
EUVD
EUVD-2026-98825

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
xen xen *
xen xen From 4.7.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79609 is a vulnerability in XPTI (Xen Page Table Isolation), a feature introduced to mitigate the Meltdown vulnerability. The issue occurs when XPTI is used on systems with large memory configurations exceeding 5 TiB (or 3.5 TiB with CONFIG_BIGMEM=y). In such cases, the directmap used by PV guests may not cover all memory, allowing a 64-bit PV guest to potentially escalate privileges to host level, access data from other guests, or cause a Denial of Service (DoS) affecting the entire host.

Detection Guidance

Detection involves checking if your system uses 64-bit PV guests with memory exceeding 5 TiB (or 3.5 TiB with CONFIG_BIGMEM=y). Review Xen hypervisor logs for memory mapping errors or guest page table issues. Use commands like 'xl info' to check memory configuration and 'xl list' to verify guest types. Ensure patches are applied for Xen versions 4.7.5 and later.

Impact Analysis

This vulnerability can allow a 64-bit PV guest to escalate privileges to host level, access data from other guests, or cause a Denial of Service (DoS) affecting the entire host. Only 64-bit PV guests on x86 systems with RAM above the specified thresholds are affected.

Compliance Impact

This vulnerability primarily impacts system security by potentially allowing privilege escalation, data access between guests, or Denial of Service on affected systems. While not directly addressing compliance standards like GDPR or HIPAA, such vulnerabilities could indirectly affect compliance by compromising data confidentiality, integrity, or availability in multi-tenant environments.

Mitigation Strategies

Avoid using 64-bit PV guests on x86 systems with RAM exceeding 5 TiB (or 3.5 TiB with CONFIG_BIGMEM=y). Limit memory usage via the 'mem=' hypervisor command line option. Apply available patches for Xen versions 4.7.5 and later, including all major releases from 4.11 onward.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart