CVE-2026-79603

This is a memory-management flaw in the Xen hypervisor on x86 systems: a paravirtualized (PV) guest can free a memory page while a stale TLB (translation lookaside buffer) entry pointing to that page still exists, and Xen only issues a TLB flush, if needed, when the page is later re-used. Because the freed page can be scrubbed (zeroed) ahead of that deferred TLB flush, a window exists in which the guest can write to a page that has already been scrubbed, potentially corrupting or tainting memory Xen believes is clean. The practical impact, per the CVSS 3.1 score of 4.3 (medium, confidentiality impact only), is limited information exposure rather than privilege escalation or denial of service. Only operators of Xen hypervisors on x86 hardware that run PV guests are affected. Exploitation status is calm: there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at just 0.2% (14th percentile).

What to do: Upgrade Xen to a patched release per the version table in Xen Security Advisory 511 v3, which fixes the issue by unconditionally performing TLB flushing ahead of page scrubbing. Prioritize hosts running untrusted or multi-tenant PV guests, and consult the advisory for any interim workarounds if patching must be deferred. Administrators can also reduce exposure by migrating workloads from PV to HVM/PVH guest modes, which are not affected by this x86 PV-specific flaw.