CVE-2026-102699 PUBLISHED

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor.

This is CVE-2026-102699.

2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory.

This is CVE-2026-102702.

All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable.

Only Arm systems are vulnerable. x86 systems are not vulnerable.

There is no known mitigation.

• CVE-2026-102699 was discovered by Leonid Komarianskyi of EPAM. It was later independently reported by Ayan Kumar Halder of AMD. CVE-2026-102702 was found by the security team while looking at the surrounding code. finder

• https://xenbits.xenproject.org/xsa/advisory-519.html

• A malicious unprivileged guest may crash the hypervisor, causing a Denial of Service (DoS) affecting the entire host, or corrupt memory belonging to another domain. Privilege escalation and information leaks cannot be ruled out.