CVE-2026-79610
Awaiting Analysis Awaiting Analysis - Queue

Race Condition in Xen Grant Table Operations

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Xen Project

Description
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-19
AI Q&A
2026-10-13
EPSS Evaluated
2026-10-18
NVD
CVE-2026-79610
EUVD
EUVD-2026-98827

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
xen xen 4.0
xen xen From 4.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a race condition in the Xen hypervisor during grant table version changes. Specifically, a v2 → v1 → v2 transition causes status pages to be freed and reallocated, leading to stale pointers becoming invalid. This can result in memory corruption and potential security issues.

Detection Guidance

Detecting this vulnerability requires checking Xen hypervisor versions and grant table configurations. Use 'xl info' to verify Xen version and 'xl list' to inspect running guests. Check if guests use grant table version 2 with 'xl debug-ps' or hypervisor logs for v2 transitions. Monitor for crashes or privilege escalation attempts in logs.

Impact Analysis

An unprivileged guest could exploit this flaw to escalate privileges, leak sensitive information, or cause a denial of service. Only x86 guests using grant table version 2 interfaces are affected, and multi-vCPU guests are required to leverage the issue.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a technical flaw in Xen's grant-table mechanism. However, exploitation could lead to unauthorized privilege escalation, information leaks, or DoS, which may indirectly impact compliance by compromising data confidentiality or availability required by these regulations.

Mitigation Strategies

Apply available patches for Xen versions 4.0+. Mitigate by setting hypervisor command line 'gnttab=max-ver:1' or guest config 'max_grant_version=1' to disable v2 grant tables. Restrict affected guests to single vCPU if possible. Monitor for unusual activity and update to patched versions promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart