Xen Hypervisor EUVD-2026-98827

Exploitation requires the attacker to execute code inside a guest VM on a Xen host and to use the grant table v2 interface, performing a v2→v1→v2 grant table version transition to trigger the free-then-reallocate of status pages that leaves stale pointers in the status array. Limiting factors: the attacker must already control a guest (local access, PR:L), must win a timing-sensitive race window (making reliable exploitation difficult and arguing for high attack complexity), and only affects hosts that run untrusted or compromisable guests using grant table v2. Single-tenant or trusted-guest deployments face materially lower real-world risk even though the hypervisor code path is present.

This is a Xen hypervisor grant table race condition (XSA-517, CWE-362) with a CVSS 3.1 base of 8.8 via AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - the scope change (S:C) and full C/I/A impact reflect a guest-to-host privilege boundary break rather than a mere in-guest issue, which is what drives the 'high' severity. The exploitation signals, however, point to low real-world urgency: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so this is best characterized as a high-impact-but-low-probability issue rather than an actively hunted target. One point of tension worth flagging: the official vector uses AC:L, but the description describes a v2→v1→v2 grant-table-version race where status pages are freed and reallocated, causing stale pointers - race conditions of this kind typically require precise timing against a narrow window, which argues for AC:H and reduces practical reliability; defenders should treat the AC:L rating as optimistic for an attacker. The Tags label this 'Information Disclosure,' but the CVSS impact (I:H/A:H plus scope change) indicates potential memory corruption of hypervisor state and host-level compromise, which is broader than pure disclosure. Net: real priority only for multi-tenant virtualization hosts running untrusted guests; patch during normal cycles, not as an emergency, given the absence of exploitation evidence.

A malicious or compromised unprivileged guest VM running on a shared Xen host rapidly toggles its grant table version (v2→v1→v2) to force the hypervisor to free and then reallocate grant status pages at a new address while another grant table operation still holds stale pointers into the old status array. By winning this race, the guest induces the hypervisor to operate on freed/relocated memory, potentially corrupting host memory to escape the guest, access other tenants' data, or crash the host. No public proof-of-concept is identified at time of analysis, and local guest code execution plus a timing window are required.