CVE-2026-102703

Frame/grant ref mixing in Xen grant copy cache

CVSS 3.1: 4.4 medium
EPSS: —
Published: Nov 4, 2026 · 5d ago
Modified: Nov 6, 2026

Analyze CVE-2026-102703 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Xen caches grant copy data for adjacent operations on same pages. Incorrect re-validation mixes frame numbers with grant references, allowing arbitrary read/write. Triggered by batches of grant copy operations by privileged users with access to shared memory. Affects Xen hypervisor; attacker gains full memory access.

What to do: Apply Xen update per Security Advisory 523 v2. No workaround given.

Product	Affected
Xen	—

Estimated exposure

No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases: - Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703. - Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704.