Xen Grant Copy Flaws Allow Malicious VMs to Read/Write Memory
November 6: Xen Security Advisory XSA-526 v1 reports use-after-free in xen-netback driver triggered by guest-supplied data.
Xen versions 4.6-4.19 grant copy flaws let malicious VMs read/write other VMs including dom0; patches available, no exploitation known.
Xen Security Advisory XSA-523 v2 publicly released details flaws in grant copy operations. Xen caches batch grant copy details on adjacent address ranges for performance, enabling arbitrary read/write via permission checks. The issues affect Xen from 4.6 to 4.19. Patches are available. No known exploitation or public attacks.
- Affects Xen 4.6 to 4.19
- CVEs: 2026-102703, 2026-102704
- Caches batch grant copy on adjacent ranges
- Permits arbitrary read/write via permission checks
- No mitigation other than patching
- No known exploitation
Timeline
dated events in the reporting · oldest first- Nov 3, 2026Public release of XSA-523 v2 on grant copy flaws · oss-security
- Nov 4, 2026Xen Hypervisor flaws allow malicious VM read/write memory of other VMs · The Hacker News
- Nov 6, 2026XSA-526 v1 on use-after-free in xen-netback driver · oss-security
What each outlet adds
beyond the shared facts- oss-securityPublic release of XSA-523 v2 details on caching for performance
- The Hacker NewsVersions affected 4.6-4.19, no exploitation known, found using Claude model
- Cyber Security NewsSeparate CVE-2026-102703 for privileged guest users and Citrix XenServer fixes
Coverage
oldest first · one row per article · UTC- · 5d ago
oss-securityFirst report
Xen XSA-523 v2 discloses arbitrary read/write via grant copy
Public release of XSA-523 v2 details batch grant copy optimizations and potential read/write issues in Xen.
- · 5d ago
The Hacker News
Xen hypervisor flaws let one VM read and write any other VM memory
Xen versions 4.6+ allow a malicious guest VM to read and write memory of other VMs including dom0 via grant copy permission checks.
- · 4d ago
Cyber Security News
Citrix XenServer Vulnerability Could Allow Host Compromise
CVE-2026-98432 in XenServer 8.4 and 9 requires management network access for unauthenticated host takeover.
- · 2d ago
Xen Linux driver vulnerable to use-after-free in network stats
A use-after-free vulnerability in the Linux xen-netback driver can be triggered by guests during network queue teardown.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100080 | Use-after-free in Linux kernel xen-netback | — | — | ||
CVE-2026-102703+1 related CVE | Frame/grant ref mixing in Xen grant copy cache | 4.4 | — | ||
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |