Loading story…
Xen disclosed XSA-486 for CVE-2026-23558, a race condition in grant table v2 status page mapping that affects Xen 4.0 and later. The flaw can be triggered on x86 HVM and PVH guests when a guest switches grant table versions from v2 to v1 while simultaneously mapping status pages through XENMEM_add_to_physmap, potentially leaving freed status pages mapped in secondary P2M page tables. Xen said successful exploitation could result in privilege escalation, information disclosure, or denial of service, including impact to the entire host.
The issue does not affect Xen 3.4 and earlier, cannot be exploited by x86 PV guests, and is not supported on Arm because grant table v2 is unavailable there. Xen published patches for xen-unstable, Xen 4.19.x, and maintained branches from 4.18.x through 4.17.x. As a mitigation, administrators can force grant table version 1 with:
gnttab=max-ver:1
max_grant_version=1
Xen credited Claude Opus 4.6 with discovering the bug and Rafal Wojtczuk with identifying it as a security issue.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Alongside the advisory, Xen released fixes for xen-unstable/Xen 4.19.x and supported Xen 4.18.x through 4.17.x branches. Xen also documented mitigations to force grant table version 1 using the hypervisor option "gnttab=max-ver:1" or the guest option "max_grant_version=1" for HVM and PVH guests.
Xen published Security Advisory XSA-486 for CVE-2026-23558, a race condition in grant table v2 status page mapping affecting Xen 4.0 and later on x86 HVM and PVH guests. The flaw can lead to privilege escalation, information disclosure, or denial of service, potentially impacting the entire host.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Xen Project disclosed **XSA-505** for **`CVE-2026-62432`**, a race condition in event channel handling between `EVTCHNOP_expand_array` and `EVTCHNOP_reset` that affects Xen versions **4.5 and later**. The flaw stems from checking whether FIFO event channels are enabled without holding the proper lock, which can result in a **NULL pointer dereference** inside the hypervisor. Xen said a malicious guest can exploit the bug to crash the host and cause **denial of service**: **HVM guests** on x86 HVM, PVH, and ARM are able to crash Xen, while a malicious **x86 PV guest** could likely also trigger memory corruption or possibly **privilege escalation**. Xen reported that versions **4.4 and earlier are not affected**, that **no mitigations** are available, and that remediation requires applying the vendor patch provided in **`xsa505.patch`** for xen-unstable and **Xen 4.17** in line with the project's security advisory process.
Jul 28, 2026
Xen has disclosed two Linux guest kernel vulnerabilities affecting virtualized environments, warning that both issues require patching and have no known mitigations. **CVE-2026-31786** (`XSA-485`) affects Linux kernels **4.13 and later** in Xen domains through unsafe handling of the binary build ID exposed at `/sys/hypervisor/properties/buildid`. The bug uses `sprintf()` on a non-null-terminated binary value, which can trigger an out-of-bounds read and, in rare cases, a write past the 4 KB sysfs buffer, potentially leading to **information disclosure, denial of service, or privilege escalation** inside Linux Xen guests. A second advisory, **CVE-2026-31787** (`XSA-487`), describes a **double-free** flaw in the Linux **Xen `privcmd` driver** that allows a **root user in a Linux guest** to bypass kernel lockdown protections tied to secure boot. Xen said the issue affects Linux **PVH or HVM domains** on **x86 and Arm** from kernel **3.8 onward**, while PV domains and non-Linux guests are not affected. The vulnerabilities were reported by **Frediano Ziglio of XenServer** and **Atharva Vartak (@0xAth4rv)**, respectively, and Xen urged operators to apply the supplied Linux patches.
Jun 29, 2026
Xen disclosed **XSA-482** for **CVE-2026-31788**, a flaw in the Linux kernel's `privcmd` driver that can let an administrator inside an unprivileged Xen guest bypass kernel lockdown protections enforced under secure boot. The bug can be abused to perform actions on the guest kernel that should be blocked in secure mode, including modifying page tables in a way that could allow user mode to alter kernel memory. The issue affects Xen **PV, PVH, and HVM** guests running Linux with secure boot enabled. Xen said BSD-based systems are believed unaffected because they do not support secure boot in this context. The vulnerability was discovered by **Teddy Astie of Vates**, no mitigation is currently known, and remediation requires applying the published Linux patch set; the latest advisory revision notes that the flaw has now been assigned **`CVE-2026-31788`**.
Jun 29, 2026