CVE-2026-102700
—UnscoredPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- —
- Complexity
- —
- Privileges needed
- —
- User interaction
- —
- Impact
- —
- Weakness
- —
Impact
A guest domain can leak page references in the Xen hypervisor, potentially leading to resource exhaustion or a denial of service. The attacker needs control of a guest VM with access to call GNTTAB_cache_flush.
Root cause
An error handling path added in XSA-232 fails to drop a page reference when the target page is owned by special system domains like DOM_IO or DOM_COW.
Affected systems
Versions not listed — check the vendor advisory.
Fix & remediation
Apply the patch from Xen advisory XSA-520; no interim configuration workaround is currently provided.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOM_IO and DOM_COW are system domains which can have memory pages assigned to them.)