CVE-2026-79602

Xen's x86 hypervisor improperly handles return codes in its HVM instruction emulation path, and a guest that has been assigned a PCI device (via passthrough) whose BAR (Base Address Register) is mapped into the I/O port address space can trigger a BUG() in the hypervisor, as documented in Xen Security Advisory 510 (CVE-2026-79602). An attacker controlling such a guest — typically a guest administrator on a host using PCI device assignment — can deliberately trigger the flaw through guest actions that go through the emulation path. The outcome is a denial of service: the BUG() crashes the host's hypervisor, disrupting all guests on that physical machine; the advisory does not indicate privilege escalation or data exposure. Only x86 Xen deployments that assign PCI devices to guests where an assigned device has an I/O port BAR are affected; hosts without passthrough, or with MMIO-only devices, are not exposed. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.2% 30-day exploitation probability (7th percentile), so no exploitation is currently known.

What to do: Update the Xen hypervisor per XSA-510 v3 (consult the advisory for the fixed version ranges applicable to your supported release), scheduling host reboots as required. Until patched, audit guest configurations for PCI device passthrough (e.g., 'xl pci-list' and guest device assignments), identify assigned devices with I/O port BARs using 'lspci -v', and avoid assigning such devices to guests or limit those guests to trusted administrators. Since the impact is a guest-triggered host crash, prioritizing patching on hosts that use device assignment is the most efficient remediation path.