CVE-2026-79609

—Unscored

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

—Unscored

Attack vector: —
Complexity: —
Privileges needed: —
User interaction: —
Impact: —
Weakness: —

Impact

A malicious 64-bit PV guest can trigger host hypervisor crashes or access unintended memory if physical memory spans beyond directmap limits. The attacker requires local control of a 64-bit PV guest on a Xen host.

Root cause

Xen Page Table Isolation (XPTI) attempts to read guest root page tables via the directmap, which does not cover memory extending past 5 TiB (or 3.5 TiB with CONFIG_BIGMEM).

Affected systems

Versions not listed — check the vendor advisory (XSA-516).

Fix & remediation

Apply the patch provided in Xen Project Advisory XSA-516, or run guests in HVM/PVH mode instead of 64-bit PV mode to mitigate.

shell

$ xl info | grep xen_version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-79609