Citrix XenServer Vulnerabilities Could Allow Malicious VM Users to Compromise Host Systems
Citrix disclosed four XenServer flaws that may let privileged guest users compromise or crash the host.
62
Vulnerability3 · 1 read
CVE-2026-102700
Xen page-reference leak in GNTTAB_cache_flush
- CVSS 3.1
- 4.7 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-102700 is a Xen hypervisor reference-counting bug in the GNTTAB_cache_flush grant-table operation. XSA-232 (CVE-2017-14318) added a missing NULL-pointer check, but the following error path was not updated and fails to drop a page reference when the page is owned by a special system domain (DOM_IO or DOM_COW). A guest that can issue GNTTAB_cache_flush can therefore leak references on those pages, which can pin or exhaust host memory and destabilize the hypervisor; the CVE text does not itself describe code execution. Xen installations and Citrix XenServer systems that include this hypercall are in scope, although exact version ranges are not stated. No public proof of concept is known, and the issue is not listed in CISA KEV.
What to do: Apply the Xen Project fix for CVE-2026-102700 and the Citrix XenServer updates in advisory AV26-1034 for your supported branch as soon as they are available. Until then, do not run untrusted guest VMs on affected hosts. Confirm the installed build against the vendor advisory; no fixed version number is given in the supplied data.
| Product | Affected |
|---|---|
| Xen Project Xen Hypervisor | — |
| Citrix XenServer | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOM_IO and DOM_COW are system domains which can have memory pages assigned to them.)
- Weakness
- CWE-404
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
In the news
3 storiesCitrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix patched four XenServer flaws, three of which could let a privileged guest compromise or crash the host.
62
Citrix security advisory (AV26-1034)
Canada's Cyber Centre urges updates for Citrix UniconOS and XenServer flaws listed in AV26-1034.
32