CVE-2026-79603

Awaiting Analysis Awaiting Analysis - Queue

Xen PV Guest Memory Page Use-After-Free Vulnerability

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Xen Project

Description

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-79603

Affected Vendors & Products

Vendor	Product	Version / Range
xen	xen	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-664	The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Attack-Flow Graph

Executive Summary

This vulnerability involves x86 PV (paravirtualized) guests in Xen being able to free memory pages while still having a stale TLB (Translation Lookaside Buffer) entry pointing to them. Xen only flushes the TLB when the page is reused, creating a window where a guest can modify a page that has already been scrubbed (cleared) but not yet flushed from the TLB.

Impact Analysis

An attacker in a PV guest could potentially read or modify memory contents of other guests or the hypervisor after the memory was freed and scrubbed, leading to information disclosure or privilege escalation. This could allow unauthorized access to sensitive data or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Xen versions may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Update Xen to the latest patched version to ensure proper TLB handling and page scrubbing synchronization. Monitor guest activity for unusual memory access patterns that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-79603. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70