Xen: x86 PV guest keeps a stale TLB entry to a freed page and can write it after scrubbing

CVSS 4.3CVE-2026-79603Kernel, userspace & hypervisorcurated

Impact

An x86 PV guest can free a page while still holding a stale TLB mapping to it. Xen only issues the deferred TLB flush when the page is reused, but scrubbing can happen before that flush, leaving a window in which the guest writes into a page Xen believes is already clean. The practical effect is that the scrub guarantee between one guest and the next owner of that memory does not hold; Xen rates it confidentiality-only and low. This only applies to x86 PV guests - hosts that run HVM or PVH guests exclusively, which is the normal configuration for accelerator and modern datacenter workloads, are not affected.

Who can reach it

An unprivileged-to-administrative user inside an x86 PV guest. No access to the host or to other guests is required, but the deployment must still be running PV guests at all.

What to do

Apply the patches published with XSA-511 and reboot the host into the fixed hypervisor. Where PV guests are not required, disabling or converting them to PVH/HVM removes the exposure without a hypervisor update.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-79603 https://xenbits.xenproject.org/xsa/advisory-511.html http://www.openwall.com/lists/oss-security/2026/09/08/8

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.