Loading vulnerability…
Xen VMX Guest Denial of Service with Branch Tracing and Blocked States
CVE-2026-79611 is a VMX guest-state handling vulnerability in the Xen hypervisor, tracked as XSA-518. Logic introduced for XSA-308 accommodates a legitimate guest state combining intercepted debug exceptions (#DB), active single-stepping, and blocking by STI or MOVSS. However, that adjustment does not correctly handle an additional case involving enabled branch tracing. The resulting VM-entry failure is fatal to the affected guest. All Xen versions are affected before application of the relevant fix, but exposure is limited to HVM and PVH guests on VMX-capable Intel, VIA, or Zhaoxin systems. PV guests and Arm, AMD, and Hygon systems are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unprivileged user executing code inside an affected HVM or PVH guest may crash that same guest, interrupting its operating system and hosted services. The vulnerability causes guest-local denial of service; it does not establish host compromise, hypervisor escape, confidentiality or integrity loss, or disruption of other guests.
If you can’t patch tonight, do this now.
Run only PV guests on affected hosts, or run HVM guests exclusively on AMD or Hygon hardware. These configurations avoid the vulnerable VMX execution path.
Patch, then assume compromise.
Apply the appropriate Xen XSA-518 patch or a vendor update incorporating it. Upstream supplies patches for xen-unstable and Xen 4.21.x, and a separate patch for Xen 4.20.x through 4.17.x; downstream maintainers should update to the relevant stable-branch tip before applying these patches. For Debian 13, upgrade Xen packages to 4.20.4+39-gf1e1321c87-0+deb13u1 or a later fixed version. For XenServer 8.4 and XenServer 9, apply the latest security updates from the selected Early Access or Normal update channel. For SUSE and Fedora, install the applicable vendor-fixed Xen hypervisor packages. Fedora 43 administrators should ensure the update includes the corrected XSA-518 patch in xen-4.20.4-5.fc43 or a later fixed build, subject to availability in the appropriate update channel.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.