Skip to main content

Xen Tapdisk CVE-2026-79605

HIGH
2026-09-08
RCE Suse
Share

Severity by source

vuln.today AI
8.8 HIGH

Guest VM controls block I/O parameters (AV:L/PR:L); no complexity; scope changes to Dom0 root yielding full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
8.4 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

2
Analysis Generated
Sep 08, 2026 - 16:17 vuln.today
CVE Published
Sep 08, 2026 - 15:44 oss-security
HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Out-of-bounds memory corruption in Xen's Tapdisk (userspace xen-blkback) enables a malicious guest VM to achieve code execution within the tapdisk process, which runs as root in Dom0, constituting a full guest-to-host escape. CVE-2026-79605 specifically covers the absent upper bounds check on blkif->last_sect: guest-supplied values greater than 7 trigger reads or writes beyond the mapped grant region. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target must run Xen with the XAPI toolstack using tapdisk as the block device backend - the default configuration for XenServer and Citrix Hypervisor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is high for any Xen deployment using the XAPI toolstack with tapdisk as the block backend. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the XSA-513 patch set (xsa513-1.patch, SHA256 41e5f1929a7acbe83820ee0b359f9558120222d32442ea4fb5a6eee0bf937bf1; xsa513-2.patch, SHA256 a5af5a73d2ede5124735213e4974f1aeff7f8118dfbacd52fbb03168fe96c6af) targeting the blktap master branch, available via the advisory at https://seclists.org/oss-sec/2026/q3/674. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running Xen Tapdisk and audit guest VM trust boundaries; restrict untrusted or internet-facing VMs from executing block device operations until remediation is available. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected

Share

CVE-2026-79605 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy