Xen (EPT): Use-after-free of EPT paging structures - HVM guest to host compromise

CVE-2026-23554Kernel, userspace & hypervisorXSA-480curated

Impact

Use-after-free of EPT paging structures - HVM guest to host compromise

Who can reach it

Tenant VM guest (HVM)

What to do

Hypervisor patch + host reboot with guest evacuation. Highest-severity recent Xen item for a multi-tenant HVM fleet

References

https://xenbits.xen.org/xsa/advisory-480.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.