CVE-2026-79610 PUBLISHED

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.

All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and earlier are not vulnerable.

Only x86 guests permitted to use grant table version 2 interfaces can leverage this vulnerability. On Arm, grant table v2 use is explicitly unsupported.

Only multi-vCPU guests can leverage this vulnerability.

Xen versions 4.13 and newer offer a way to build Xen without grant table support. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not vulnerable.

Using the "gnttab=max-ver:1" hypervisor command line option will avoid the vulnerability.

Using the "max_grant_version=1" guest configuration option for guests will also avoid the vulnerability.

• This issue was discovered by Claude Opus and diagnosed as a security issue by Teddy Astie of Vates. finder

• https://xenbits.xenproject.org/xsa/advisory-517.html

• An unprivileged guest may be able to elevate its privileges to that of the host. Information leaks and Denial of Service (DoS) are possible as well.