Xen EUVD-2026-49780

Exploitation requires the Xen hypervisor to be in the process of switching the grant table version from v1 to v2. This is a transient state initiated by a hypercall from a guest VM (typically by a privileged domain, e.g., dom0). The race window exists during the specific code path where the grant table lock is dropped and reacquired. The attacker must be able to execute code in a guest VM capable of triggering the version switch and must win a race condition with precise timing. No authentication is required from the network perspective, but the attacker must already have guest VM access (local to the hypervisor).

CVSS 6.5 (Medium) with network attack vector, low complexity, no privileges, and no user interaction suggests a seemingly critical attack surface. However, the race condition only manifests during a specific operational event (version switch from v1 to v2), which is not a continuously running state. The impact is limited to low confidentiality and low availability, and there is no evidence of active exploitation (no CISA KEV listing) or public exploit code. EPSS data was not provided, but given the narrow trigger window and low impact, the real-world risk is likely low to medium. The given CVSS vector (AV:N) may overstate remote exploitability, as the attacker must already be able to execute hypercalls from a guest VM, which is better modeled as AV:L or AV:A.

A malicious guest VM with the ability to issue hypercalls triggers a grant table version switch from v1 to v2. By timing its actions precisely when the hypervisor code drops and reacquires the lock, the attacker causes a race condition that leads to an inconsistent grant reference count, allowing reading of sensitive hypervisor memory or corrupting grant mappings, resulting in denial of service. No public proof-of-concept exploit is known.