CVE-2026-23558 PUBLISHED

The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of the status pages may then be freed while mappings of them would still be inserted into the guest's secondary (P2M) page tables.

All Xen versions from 4.0 onwards are affected. Xen versions 3.4 and older are not affected.

Only x86 HVM and PVH guests permitted to use grant table version 2 interfaces can leverage this vulnerability. x86 PV guests cannot leverage this vulnerability. On Arm, grant table v2 use is explicitly unsupported.

Using the "gnttab=max-ver:1" hypervisor command line option will avoid the vulnerability.

Using the "max_grant_version=1" guest configuration option for HVM and PVH guests will also avoid the vulnerability.

• This issue was discovered by Claude Opus 4.6 and diagnosed as a security issue by Rafal Wojtczuk. finder

• https://xenbits.xenproject.org/xsa/advisory-486.html

• Privilege escalation, information leaks, and Denial of Service (DoS) up to affecting the entire host cannot be excluded.