Xen hypervisor: Race condition in grant table version change
Summary
A race condition in the Xen grant table code allows a guest to make previously calculated pointers into the status array stale when it switches grant table versions from v2 to v1 and back to v2. An unprivileged guest may be able to escalate its privileges to the host. Information leaks and denial of service are also possible. The attack requires a local guest that is permitted to use grant table v2 and has multiple vCPUs.
Affected
- All Xen versions from 4.0 onwards
- Xen versions 3.4 and earlier are not affected
- Only x86 guests permitted to use grant table v2 interfaces
- Only multi-vCPU guests
- Not affected: Arm (grant table v2 is unsupported) and builds with CONFIG_GRANT_TABLE disabled (Xen 4.13 and newer)
Fixed in
- Apply the patch xsa517.patch (SHA256 0f114af84cd925f8bc69b26386e2e4a95a52f947bc400f961a9e1ba46c0a2e05) from XSA-517
- Patches for released versions may not apply cleanly to release tarballs; use the tip of the stable branch
- Vendor fixes: Debian DSA 6571-1, SUSE-SU-2026:4642-1, Citrix XenServer hotfixes per vendor bulletin, XCP-ng (pull request, check official announcements)
- Exact fixed versions for all branches: Unknown.
Workaround
- Set the hypervisor command line option gnttab=max-ver:1
- Or set max_grant_version=1 in the guest configuration
- Restricting the grant table version is a guest-visible change; according to the advisory, deploying this mitigation on public cloud systems was not permitted during the embargo, but the embargo has ended
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- No public proof of concept found in research
- Not listed in CISA KEV (per OpenCVE)
- No evidence of active exploitation in the reviewed advisories
Our recommendation
- Check whether Xen-based hypervisors are in use, including XenServer, XCP-ng, SUSE and Debian packages
- Patch affected hypervisors through the vendor channel in the normal patch cycle
- If patching is not possible immediately, apply the max-ver:1 or max_grant_version=1 workaround
- Prioritise multi-tenant hosts and hosts running untrusted guests
- Monitor vendor advisories for final fixed versions
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Xen Security Advisory XSA-517 xenbits.xenproject.org
- Openwall oss-security mailing list www.openwall.com
- Citrix security bulletins for XenServer support.citrix.com
- SUSE-SU-2026:4642-1 vulners.com
- Debian DSA for CVE-2026-79610 vulners.com
- XCP-ng RPM fix pull request github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:07.
Original description (NVD)
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.