CVE-2026-79611 PUBLISHED

For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest.

Sadly there is another special sub-case of the above, with branch tracing enabled. In that case the prior adjustment would still cause a VMentry failure, as before fatal to the guest.

All versions of Xen are affected.

Only systems supporting VMX hardware virtual extensions (Intel, VIA or Zhaoxin CPUs) are affected. Arm as well as AMD and Hygon systems are unaffected.

Only HVM/PVH guests are affected. PV guests cannot leverage the vulnerability.

Running only PV guests will avoid this vulnerability.

Running HVM guests on only AMD or Hygon hardware will also avoid this vulnerability.

• This issue was discovered by Claude Opus and diagnosed as a security issue by Teddy Astie of Vates. finder

• https://xenbits.xenproject.org/xsa/advisory-518.html

• HVM/PVH guest userspace code may be able to crash the guest, resulting in a guest Denial of Service.