Loading vulnerability…
Stack buffer overflow in Xen tapdisk
CVE-2026-102701 is a stack buffer overflow in tapdisk's tap_ctl_connect_xenblkif() function. Tapdisk, a userspace Xen block backend used by the XAPI toolstack, fails to validate the frontend-requested multi-page ring size during connection and assumes it does not exceed eight. A malicious or buggy guest can exceed this limit and trigger a stack overflow, potentially executing code in the tapdisk process, which normally runs as root. All tapdisk versions are affected; affected XenServer releases include 8.4 and 9.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A privileged guest VM user may compromise or crash the underlying host. Successful exploitation of the stack overflow could execute arbitrary code with the privileges of tapdisk, normally root, crossing the guest-to-host security boundary. A host crash can disrupt workloads running on that host.
If you can’t patch tonight, do this now.
Xen Security Advisory XSA-521 identifies no available mitigations. Apply the security patch rather than relying on an interim workaround.
Patch, then assume compromise.
Apply the blktap master patch supplied with Xen Security Advisory XSA-521. For XenServer 8.4 and 9, install the latest applicable security updates from the deployment's Early Access or Normal update channel, following bulletin CTX697170. Specific fixed build numbers are not identified, and the reported XenServer product version does not change after patching; verify update installation rather than relying solely on that version.
No public exploits tracked yet. Mallory keeps watching.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.