EUVD-2026-98830
GHSA-hghw-wh6h-2jx6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl a guest domain on Arm64 Xen host
-
ExploitIssue crafted GNTTABOP_cache_flush hypercall
-
ExecutionTrigger integer underflow excessive loop
-
ImpactHang and crash hypervisor, DoS all guests
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Requires an attacker who already controls a guest domain and can issue the GNTTABOP_cache_flush grant-table hypercall; the crash path is specifically described as manifesting on 64-bit Arm hypervisors, where the underflow produces an excessively long loop that likely crashes the hypervisor. Limiting factors that reduce real-world risk: the attacker must run code inside a guest VM (not reachable from the open network despite PR:N in the vector), impact is availability-only (no data disclosure or code execution), and the practical crash condition is tied to the 64-bit Arm platform. Non-Arm or single-tenant deployments face materially lower risk. |
| Impact | This is a guest-triggered hypervisor denial-of-service in Xen (XSA-519). The CNA CVSS of 7.5 is driven entirely by availability (A:H); there is no confidentiality or integrity impact (C:N/I:N). The supplied vector lists AV:N/PR:N (network, unauthenticated), but the vulnerability is actually reached via the GNTTABOP_cache_flush hypercall issued from within a guest domain - realistically local to the host and requiring control of a guest VM - so the AV:N/PR:N framing overstates reachability and should be read as 'from the guest-facing hypercall interface' rather than 'from the open network'; verify deployment context. Corroborating signals point to low real-world urgency: EPSS is 0.15% (3rd percentile), there is no CISA KEV listing, and no public exploit code is identified. The impact is also platform-gated - the excessive loop/crash is described as occurring 'at least on 64-bit Arm.' Net assessment: a legitimate priority for multi-tenant 64-bit Arm Xen hosts (a malicious tenant can crash the hypervisor and take down all co-resident guests), but a lower-priority, high-CVSS-but-low-likelihood item for single-tenant or non-Arm deployments. The high CVSS reflects worst-case availability impact, not widespread exploitation probability. |
| Exploit ScenarioDerived | A tenant who controls a guest VM on a 64-bit Arm Xen host issues a specially crafted GNTTABOP_cache_flush hypercall whose parameters trigger the integer underflow introduced by the XSA-437 fix. The resulting near-unbounded loop ties up and likely crashes the hypervisor, denying service to the host and all co-resident guests. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 20, 2026
Guest-triggered denial of service in Xen Hypervisor can drive 64-bit Arm hosts into an excessively long cache-flush loop and likely crash the hypervisor. The issue is an integer underflow in the GNTTABOP_cache_flush grant-table path introduced by the earlier XSA-437 fix; an attacker able to run code in a guest and issue the hypercall can exhaust host CPU and availability. No public exploit was identified at time of analysis, and EPSS is low at 0.15%.
Earlier versions of this analysis (1)
An unprivileged guest VM on Arm-based Xen hosts can trigger a size-calculation underflow in the GNTTABOP_cache_flush grant-table hypercall, causing an excessively long loop that crashes the hypervisor and results in a host-wide denial of service; memory corruption in another domain, privilege escalation, and information leaks cannot be ruled out. The flaw affects Xen 4.5 through 4.21.x on Arm only (x86 is not vulnerable), and the related XSA-519 advisory also covers CVE-2026-102702, which permits invalidate-without-clean operations against read-only grant mappings. No public exploit code was identified at time of analysis, and no KEV or EPSS signal was provided in the input; the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, with no known mitigation other than patching.
RemediationAI
Apply the Xen security advisory XSA-519 fix and follow the vendor version matrix at https://xenbits.xenproject.org/xsa/advisory-519.html; the exact patched version is not specified in the supplied data. Until patched, avoid running untrusted guest domains on affected 64-bit Arm hosts, or move them to dedicated/trusted hosts, accepting reduced tenant density and higher cost as the trade-off. Monitor host CPU consumption and hypervisor stability for abnormal cache-flush behavior as a detection-only control, and do not rely on generic network filtering because the trigger originates from guest code executing the grant-table hypercall.
Affected ProductsAI
Xen hypervisor builds that contain the XSA-437 (CVE-2023-34321) cache-flush fix are the relevant exposure set, particularly when running on 64-bit Arm hypervisors where the underflow can produce the excessively long loop. The supplied data does not provide exact version ranges or CPE strings, so the precise affected-version matrix should be taken from Xen advisory XSA-519 at https://xenbits.xenproject.org/xsa/advisory-519.html. Non-Arm deployments and single-tenant environments where guests are fully trusted face materially lower practical risk.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Xen's grant table allows domains to share memory and issue operations such as GNTTABOP_cache_flush. XSA-437 (CVE-2023-34321) corrected overflow issues in cache-flush calculations, but CVE-2026-102699 identifies that the fix can underflow a calculation, creating a loop that takes excessively long on 64-bit Arm and can eventually crash the hypervisor. The root cause maps to CWE-191 (Integer Underflow). The assessed impact is availability-only (C:N/I:N/A:H, S:C) and requires an attacker who already controls a guest domain and can issue the hypercall; this is not reachable from the open network. The companion CVE-2026-102702 concerns invalidate-without-clean on read-only grant mappings and is separate from this cache-flush underflow.
Know when Xen gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitation requires running in a guest VM and issuing a hypercall, so AV:L/PR:L; a guest crashing the hypervisor is a scope change (S:C) with availability-only impact (A:H).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Executive ViewAI
Xen Hypervisor deployments on 64-bit Arm hosts face a guest-triggered availability risk: a malicious or compromised guest can drive the host into excessive cache-flush processing likely resulting in hypervisor crash and CPU exhaustion. Leadership should care because a single untrusted guest workload could disrupt all co-hosted services, causing SLA breaches and operational downtime in multi-tenant or consolidated virtualization environments. Exploitation requires the ability to run code within a guest, and current public exploit likelihood is low, but no vendor patch is yet available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting guest code execution to trusted tenants, isolating untrusted guests on separate 64-bit Arm hosts, monitoring for abnormal cache-flush or hypercall-driven CPU exhaustion, and applying any Xen advisory guidance to limit or disable the GNTTABOP_cache_flush path where operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aj
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recu
An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. Rated
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (hos
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text exp
Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obt
Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217
The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_h
Exploit-DB