Xen Security Advisory 511 v3 (CVE-2026-79603) - Unconditionally do TLB flushing ahead of page scrubbing
Xen Project released XSA-511 (CVE-2026-79603) fixing missing TLB flushes before page scrubbing that can leak x86 PV guest data.
Xen Security Advisory 511 v3 publicly discloses CVE-2026-79603, a TLB handling flaw in the Xen hypervisor on x86. x86 PV guests can free memory pages while a stale TLB entry still points to them, and Xen only flushes the TLB when the page is reused, potentially exposing stale data ahead of scrubbing. The advisory changes Xen to unconditionally flush the TLB ahead of page scrubbing. The issue was published in version 3 of the advisory.
35