CVE-2026-79609
Received Received - Intake

XPTI Bypass via Directmap Access in Xen Hypervisor

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Xen Project

Description
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-79609
EUVD
EUVD-2026-98825

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
xen xen *
xen xen From 4.7.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79609 is a vulnerability in XPTI (Xen Page Table Isolation), a feature introduced to mitigate the Meltdown vulnerability. The issue occurs when XPTI is used on systems with large memory configurations exceeding 5 TiB (or 3.5 TiB with CONFIG_BIGMEM=y). In such cases, the directmap used by PV guests may not cover all memory, allowing a 64-bit PV guest to potentially escalate privileges to host level, access data from other guests, or cause a Denial of Service (DoS) affecting the entire host.

Impact Analysis

This vulnerability can allow a 64-bit PV guest to escalate privileges to host level, access data from other guests, or cause a Denial of Service (DoS) affecting the entire host. Only 64-bit PV guests on x86 systems with RAM above the specified thresholds are affected.

Mitigation Strategies

Avoid using 64-bit PV guests on x86 systems with RAM exceeding 5 TiB (or 3.5 TiB with CONFIG_BIGMEM=y). Limit memory usage via the 'mem=' hypervisor command line option. Apply available patches for Xen versions 4.7.5 and later, including all major releases from 4.11 onward.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart