CVE-2026-62436
Received Received - Intake

Grant Table Version Switching Privilege Escalation

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Xen Project

Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, as a bigger shared entry structure is then needed while the shared table doesn't change size. Switching from v2 back to v1 the status frames, which are separate in v2, go away. Code holding, but intermediately dropping and then re-acquiring the grant table lock, sometimes wrongly assumes that said properties wouldn't change across the window in time where the lock is not being held. The v1 -> v2 issue is CVE-2026-62435. The v2 -> v1 issue is CVE-2026-62436.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-62436
EUVD
EUVD-2026-49781

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
xen xen From 4.0.0 (inc) to 3.4 (exc)
xen xen 4.17
xen xen 4.18
xen grant_table v1
xen grant_table v2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62436 involves a flaw in Xen's Grant Table v2 switching mechanism. When switching from Grant Table v2 back to v1, status frames that were separate in v2 are removed. Code that temporarily releases and re-acquires the grant table lock may incorrectly assume these properties remain unchanged during the window without the lock.

Detection Guidance

This vulnerability is specific to Xen's grant table version switching mechanism and requires privileged access to exploit. Detection primarily involves checking Xen version and configuration rather than network scanning. Verify if your system uses grant table version 2 with x86 multi-vCPU guests by examining Xen logs and configuration files.

Impact Analysis

This vulnerability could allow an attacker to manipulate grant table references or cause unexpected behavior in Xen-based systems by exploiting the incorrect assumption about grant table properties during lock transitions.

Compliance Impact

This vulnerability primarily impacts system security by allowing privilege escalation, information leaks, or Denial of Service (DoS) attacks. While it does not directly affect compliance with standards like GDPR or HIPAA, such incidents could lead to data breaches or unauthorized access, which may violate these regulations depending on the context of use.

Mitigation Strategies

Immediately apply available patches for Xen 4.17.x, 4.18.x, or unstable versions. Alternatively, mitigate by adding 'gnttab=max-ver:1' to hypervisor command line or 'max_grant_version=1' to guest configuration. For Xen 4.13+, consider building without grant table support. Restrict access to multi-vCPU x86 guests until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart