Skip to main content

Xen Tapdisk CVE-2026-79606

HIGH
2026-09-08
RCE Suse
Share

Severity by source

vuln.today AI
8.8 HIGH

Attack originates from within a guest VM (AV:L); controlling a VM requires minimal privilege (PR:L); scope changes from guest to root dom0 (S:C) with full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
6.5 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

2
Analysis Generated
Sep 08, 2026 - 16:17 vuln.today
CVE Published
Sep 08, 2026 - 15:44 oss-security
HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Out-of-bounds memory corruption in Tapdisk, the XAPI toolstack's userspace xen-blkback implementation, allows a malicious guest VM to achieve code execution inside the tapdisk process, which normally runs as root in dom0. CVE-2026-79606 specifically concerns the gcopy_segs[] array: the bounds check incorrectly permits nr_segments values between 12 and 32, causing out-of-bounds writes that corrupt adjacent process memory. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must control a guest VM on a Xen host where the XAPI toolstack is deployed (XenServer, XCP-ng) and tapdisk is actively serving a virtual block device to that guest. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a guest-to-host privilege escalation of the most severe class: an attacker controlling a guest VM can corrupt tapdisk memory and achieve arbitrary code execution as root in dom0, yielding full compromise of the hypervisor host and all co-resident VMs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the patches released with XSA-513: xsa513-1.patch (SHA-256: 41e5f1929a7acbe83820ee0b359f9558120222d32442ea4fb5a6eee0bf937bf1) and xsa513-2.patch (SHA-256: a5af5a73d2ede5124735213e4974f1aeff7f8118dfbacd52fbb03168fe96c6af), targeting the blktap master branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Xen XAPI hosts running tapdisk and segregate or suspend guest VMs from untrusted sources; request XSA-513 patches from your Xen vendor immediately. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected

Share

CVE-2026-79606 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy