CVE-2026-79611
5.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-843
Impact
A local unprivileged guest user can crash the guest VM, triggering a denial of service. The attacker needs local access within the target Xen guest to run code triggering specific CPU debug and branch tracing states.
Root cause
An incomplete fix for XSA-308 mishandles VMX VMEntry checks when single-stepping, blocked by STI/MovSS, and branch tracing are simultaneously enabled, triggering a fatal VMEntry failure.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Apply the patch from Xen Security Advisory XSA-518; no interim configuration workaround is specified in the advisory.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest. Sadly there is another special sub-case of the above, with branch tracing enabled. In that case the prior adjustment would still cause a VMentry failure, as before fatal to the guest.