2026-10-13

Guest-to-host privilege escalation in Xen's tapdisk (blktap) userspace xen-blkback backend lets a malicious or buggy guest VM crash or potentially execute code as host root: all versions of tapdisk are affected because the device-connect path performs no boundary check on the multi-page ring size requested by the frontend. Exploitation requires only that the host runs the XAPI toolstack with tapdisk as the block backend and that the attacker already controls a guest VM attached to it (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), with no user interaction on the host side; the vulnerability is reachable under default configurations, and the Xen Security Advisory states there are no mitigations. No public exploit code or active exploitation has been identified at time of analysis, and the fix is an upstream patch (xsa521.patch) for blktap master rather than a named released version.