CVE-2026-102700 PUBLISHED

With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOM_IO and DOM_COW are system domains which can have memory pages assigned to them.)

Xen versions 4.5 through 4.20 are affected. Xen versions 4.21 and newer as well as 4.4 and older are not affected.

Only x86 systems are vulnerable. Arm systems are not vulnerable.

There is no known mitigation.

• This issue was discovered independently by Andrew Cooper of Citrix and Yehyeong Lee. finder

• https://xenbits.xenproject.org/xsa/advisory-520.html

• The most likely outcome is Denial of Service (DoS) of either Domain 0 (then likely affecting the entire host) or of another domain.