CVE-2026-79610
—UnscoredPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- —
- Complexity
- —
- Privileges needed
- —
- User interaction
- —
- Impact
- —
- Weakness
- —
Impact
A malicious guest VM can likely crash the hypervisor or achieve host privilege escalation via stale pointer dereferencing. The attacker needs local access and permission to modify grant table versions within a Xen guest.
Root cause
Switching grant table versions from v2 to v1 and back to v2 reallocates status pages, leaving previously calculated status array pointers stale and pointing to freed memory.
Affected systems
Xen hypervisor (exact versions not listed in advisory excerpt — check XSA-517).
Fix & remediation
Apply the patch provided in Xen Security Advisory 517 (XSA-517). No configuration-based interim workaround is specified; patching and rebooting the hypervisor host is required.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.