Loading vulnerability…
Arbitrary cross-domain memory access in Xen Grant Copy
CVE-2026-102703 is an incorrect authorization vulnerability in Xen's Grant Copy processing, affecting unpatched Xen versions from 4.6 onward. Xen caches validated information when processing batches of copy operations involving adjacent address ranges within the same source or destination page. Incorrect conditions for revalidating this cached information allow frame numbers and grant references to be confused, permitting a malicious guest to read and write arbitrary memory belonging to other domains, including the privileged management domain, Dom0. The vulnerability is addressed by Xen Security Advisory XSA-523. It is distinct from CVE-2026-102704, which concerns a misplaced memory-ownership check.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation breaks guest memory isolation and compromises the confidentiality and integrity of memory belonging to other guests and Dom0. Access to management-domain memory can enable guest-to-host privilege escalation and potentially complete host compromise, depending on the memory accessed and subsequent exploitation. Other virtual machines managed by the compromised host may consequently be exposed.
If you can’t patch tonight, do this now.
No known workaround prevents exploitation on an affected Xen host. Temporarily stopping or moving untrusted guests to patched hosts can reduce exposure but does not fix the vulnerable hypervisor. Moving guests to another unpatched host does not resolve the risk.
Patch, then assume compromise.
Apply the appropriate XSA-523 patches or install security-fixed Xen packages supplied by the platform vendor on the physical host. Complete the required host or Dom0 restart so that the patched hypervisor is active; updating guest operating systems alone does not resolve the vulnerability. Fixed packages include Debian 13 Xen 4.20.4+63-g7abfd2bce2-0+deb13u1, XCP-ng 8.3 Xen 4.17.7-4.2.xcpng8.3, and Qubes OS 4.3 Xen 4.19.6-3. For XenServer 8.4 and XenServer 9, install the applicable updates from the Normal or Early Access channel. Upgrade unsupported Xen installations to a supported, patched release and verify the running hypervisor build after restarting.
No public exploits tracked yet. Mallory keeps watching.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.