Loading vulnerability…
Page-reference leak in Xen grant-table cache-flush handling
CVE-2026-102700 is a page-reference leak in the Xen hypervisor's GNTTAB_cache_flush error handling, tracked as XSA-520. The NULL-pointer check introduced to address XSA-232 (CVE-2017-14318) did not correctly update the subsequent cleanup path. When the specified page belongs to a special system domain, such as DOM_IO or DOM_COW, this error path fails to release a page reference. The vulnerability affects Xen 4.5 through 4.20 on x86 systems and can cause denial of service affecting Domain 0 or another domain. Arm systems, Xen 4.4 and earlier, and Xen 4.21 and later are unaffected. Within XenServer, this CVE affects version 8.4 only.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The most likely impact is denial of service affecting Domain 0 or another domain. Disruption of Domain 0 would likely affect the entire host and its workloads. The vulnerability-specific severity assessment identifies high availability impact without confidentiality or integrity impact. Although XenServer's grouped advisory mentions possible host compromise or crashes across several vulnerabilities, it does not establish host compromise specifically for this CVE.
If you can’t patch tonight, do this now.
No known mitigation or workaround is identified in XSA-520.
Patch, then assume compromise.
Apply the appropriate Xen security patch for XSA-520 or install a vendor-supported Xen package update containing the fix. The upstream patch is designated for Xen 4.17.x through 4.20.x; downstream maintainers should update to the tip of the applicable stable branch before applying it. Xen 4.21 and later are unaffected. For XenServer 8.4, install the latest updates from the deployment's Early Access or Normal update channel; the update does not change the reported product version, so version-only detection cannot verify installation. For Debian 13, upgrade Xen packages to 4.20.4+39-gf1e1321c87-0+deb13u1 or a later fixed version. For other distributions, install the applicable released Xen security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.