CVE-2026-102699
—UnscoredPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- —
- Complexity
- —
- Privileges needed
- —
- User interaction
- —
- Impact
- —
- Weakness
- —
Impact
A malicious guest domain can crash the host hypervisor or trigger an excessively long loop, leading to a denial of service. The attacker needs an unprivileged guest domain capable of executing cache flush hypercalls.
Root cause
A calculation introduced in the patch for XSA-437 can underflow during GNTTABOP_cache_flush operations, causing an infinite or excessively long loop.
Affected systems
Xen on 64-bit Arm with the XSA-437 (CVE-2023-34321) patch applied; exact Xen version ranges are not listed — check the vendor advisory.
Fix & remediation
Apply the patch or updated hypervisor release provided in Xen advisory XSA-519. No known interim configuration workaround exists; patching the Xen hypervisor is required.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702.