Xen publishes XSA-510 through XSA-513 (v3): four advisories covering hypervisor crashes, data exposure, oxenstored resource exhaustion, and Tapdisk out-of-bounds flaws

On 2026-09-08 the Xen Project publicly released version 3 of four security advisories — XSA-510, XSA-511, XSA-512, and XSA-513 — fixing five CVEs spanning guest-triggered hypervisor crashes, stale-TLB data exposure in x86 PV guests, unbounded watch…

The Xen Project issued public version 3 releases of four Xen Security Advisories on 2026-09-08. XSA-510 (CVE-2026-79602) addresses improper handling of HVM emulation return codes in the Xen hypervisor on x86: a guest with an assigned PCI device that has at least one BAR in IO port space can trigger a BUG() and crash Xen. XSA-511 (CVE-2026-79603) fixes a TLB handling flaw where x86 PV guests can free memory pages while stale TLB entries still point to them; Xen previously flushed the TLB only when a page was reused, potentially exposing stale data ahead of scrubbing, and the fix makes TLB flushing unconditional before page scrubbing. XSA-512 (CVE-2026-79604) concerns oxenstored, the OCaml xenstore implementation, which maintains a global trie and per-domain hashtable for watches; on a xenbus reconnect, watches are not cleared from the global structure, allowing unbounded accumulation of watches and resource exhaustion. XSA-513 (CVE-2026-79605 and CVE-2026-79606) covers out-of-bounds access flaws in Tapdisk, the userspace xen-blkback implementation used by the XAPI toolstack, caused by several incorrect bounds checks including a missing upper bounds check. All four advisories were published on oss-security as version 3 public disclosures on the same date.