Xen: guest with a passthrough PCI device exposing an IO port BAR can trigger a hypervisor BUG()

Impact

A guest that has been assigned a PCI device with at least one BAR in IO port space can reach a BUG() in Xen. A BUG() in the hypervisor takes down the host, not just the offending guest, so one tenant VM crashes every other VM on that machine. On a GPU host this is expensive: device assignment is exactly how accelerators and SR-IOV NICs are handed to tenants, and a crashed hypervisor means an unplanned reboot of a node whose GPU workloads cannot be live-migrated. XSA-510 does not state that GPUs themselves carry IO port BARs - the trigger is any assigned device that does, which on modern hosts is more often a legacy or bridged function than the accelerator.

Who can reach it

A guest administrator on any VM that already has a PCI device passed through to it. No host credentials needed; the tenant only has to drive the device it was legitimately given.

What to do

Apply the patches published with XSA-510 to the hypervisor and reboot the host into the fixed Xen - Xen patches do not take effect on a running hypervisor. Drain or migrate guests first; VMs holding assigned GPUs cannot be live-migrated and must be stopped. As an interim mitigation, stop assigning PCI devices that expose IO port BARs to untrusted guests.

References

Related entries

• libcurl: pooled TLS connection outlives its easy handle and reuses a freed OpenSSL library contextCVE-2026-80229 · libcurl (multi interface, OpenSSL 3 provider library context)Unscored
• Linux kernel CephFS client: readers hang indefinitely after cap revocation leaves stale mds_wantedCVE-2026-80527 · Linux kernel CephFS client (__ceph_get_caps / ceph_renew_caps, stale cap->mds_wanted)Unscored
• Linux kernel CephFS client: reclaim during MDS reply handling crashes the kernel via ext4 journal_infoCVE-2026-80528 · Linux kernel CephFS client (handle_reply / current->journal_info vs direct reclaim)Unscored
• Linux kernel libceph: out-of-bounds read in decode_watchers() from a zero-length struct_lenCVE-2026-80557 · Linux kernel libceph (decode_watchers(), CEPH_OSD_OP_LIST_WATCHERS reply parsing)Unscored
• Linux kernel libceph: unvalidated primary_temp OSD index causes out-of-bounds array readsCVE-2026-80558 · Linux kernel libceph (get_temp_osds(), unvalidated primary_temp OSD index)Unscored
• Linux kernel libceph: unchecked decodes in decode_locker() let a malicious OSD read out of boundsCVE-2026-80561 · Linux kernel libceph (cls_lock_client decode_locker)Unscored