Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges by

Impact

A 32-bit PV guest administrator gains full host privileges by abusing the fast paths for pagetable entry updates - the hypervisor lets the guest make its own pagetables writable and from there it owns the machine. This is the highest-stature generic Xen escape of the era; it is the bug that forced Qubes OS to abandon PV isolation architecturally. For a multi-tenant operator the point is that it needs no device assignment and no exotic hardware: any tenant renting a PV instance escapes to the host and to every co-tenant on it.

Who can reach it

Guest administrator in a paravirtualised (PV) guest. HVM and PVH guests are not affected.

What to do

Apply the XSA-182 patches and reboot the hypervisor across the fleet, evacuating tenants node by node. The durable answer is architectural rather than a patch: stop offering PV guests and move tenants to HVM/PVH, which is what the Xen ecosystem did after this. If you are still running PV instances in 2026 because a legacy customer needs them, that is a business decision to price and time-box, not a technical constraint.

References