Loading vulnerability…
Xen grant table v2 status-page mapping race condition
CVE-2026-23558 is a race condition in Xen grant table v2 status-page mapping, tracked as XSA-486. An x86 HVM or PVH guest can switch its grant table from version 2 to version 1 while concurrently mapping status pages through XENMEM_add_to_physmap. Status pages may consequently be freed while mappings to them are still inserted into the guest's secondary physical-to-machine (P2M) page tables, resulting in use-after-free. Earlier fixes for XSA-379 and XSA-387 did not eliminate this race window. Xen versions 4.0 onward are affected when guests are permitted to use grant table v2; Xen 3.4 and earlier are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A malicious privileged user in an affected guest may escape guest isolation and escalate privileges to the hypervisor level, potentially compromising the host. Information disclosure and denial of service affecting the entire host are also possible. x86 PV guests cannot leverage this vulnerability, and grant table v2 is explicitly unsupported on Arm.
If you can’t patch tonight, do this now.
Prevent use of grant table version 2 by setting the Xen hypervisor command-line option "gnttab=max-ver:1", or configure each HVM and PVH guest with "max_grant_version=1".
Patch, then assume compromise.
Apply the appropriate Xen XSA-486 patch or install the distribution's fixed Xen packages. Upstream patches cover xen-unstable and Xen 4.19.x, with a separate patch for Xen 4.18.x and 4.17.x; downstreams should update to the relevant stable-branch tip before applying patches. Fixed packages include Xen 4.17.7-0+deb12u1 for Debian 12, Xen 4.20.3+127-gc42374a105-0+deb13u1 for Debian 13, and xen-4.17.6-6.2.xcpng8.3 or later for XCP-ng 8.3 LTS. XenServer 8.4 deployments should install the latest updates from their selected Early Access or Normal update channel.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.