Xen XPTI: PV guest memory above the directmap boundary leads to host compromise from a PV guest

Impact

XPTI, the Meltdown mitigation, copies a 64-bit PV guest's chosen root page-table entries through the directmap. On hosts where PV guest memory extends past the 5 TiB boundary (3.5 TiB with CONFIG_BIGMEM), the directmap does not cover that memory, so Xen reads outside it while building the page tables hardware actually uses. The CVSS scope-change vector with high confidentiality, integrity and availability means a PV guest user can escape its guest and affect the host - on a GPU host that is every co-tenant VM on the box, including any with passed-through accelerators. Large-memory GPU hosts are exactly the configuration that crosses the 5 TiB threshold.

Who can reach it

A local, authenticated user inside a 64-bit PV guest on a Xen host with more than 5 TiB (or 3.5 TiB with CONFIG_BIGMEM) of memory and XPTI enabled. No access to the host or management network is needed.

What to do

Apply the patches in Xen XSA-516 and reboot the hypervisor, which means draining and rebooting every GPU node running affected Xen. Hosts that run only HVM/PVH guests, or that have XPTI off, or that have less memory than the directmap boundary are not exposed - check those conditions before scheduling the window. Consult XSA-516 for the exact affected versions.

References

Related entries

• Linux kernel KVM s390 vsie: stale crypto bits let a nested guest reach a revoked crypto deviceCVE-2026-80921 · Linux kernel KVM s390 vsie (crypto control block shadowing)High
• Linux iommufd: use-after-free on a borrowed attach handle in the selftest IOPF pathCVE-2026-89445 · Linux kernel iommufd selftest mock driver (TRIGGER_IOPF attach handle)High
• Linux kernel vfio/pci: freed MSI permission table left in the device, giving use-after-free and double freeCVE-2026-89777 · Linux kernel vfio/pci (vdev->msi_perm dangling pointer on init failure)High
• Linux kernel qla2xxx: host_map btree updated without vport_slock in the format-1 path, corrupting the mapCVE-2026-89844 · Linux kernel scsi qla2xxx (report ID acquisition, vport_slock host_map)High
• Linux kernel qla2xxx: unexpected status IOCB for a non-SCSI handle causes a wild pointer dereferenceCVE-2026-89849 · Linux kernel qla2xxx (QLogic Fibre Channel HBA status IOCB fast path)High
• Linux kernel qla2xxx: re-initializing a queued work item on a repeated FC-NVMe abort corrupts the workqueue listCVE-2026-89860 · Linux kernel qla2xxx (FC-NVMe abort path, priv->abort_work)High