Quick answers
- Is CVE-2026-102699 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-102699 being exploited in the wild.
- How severe is CVE-2026-102699?
- Informational severity, published 13 October 2026.
- Which products and versions are affected?
- Xen Hypervisor 4.5 through 4.21.x on Arm platforms.
- Is there a fix for CVE-2026-102699?
- No fixed version is recorded yet. There is no known mitigation; patching is required.</anigation> <parameter name="fixed_in">Xen 4.21.x (via xsa519-1.patch and xsa519-2.patch), Xen 4.20.x through 4.17.x (via xsa519-4.20-1.patch and xsa519-4.20-2.patch)</anitation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-102699 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-102699?
- Check whether you run Xen Hypervisor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
There is no known mitigation; patching is required.</anigation> <parameter name="fixed_in">Xen 4.21.x (via xsa519-1.patch and xsa519-2.patch), Xen 4.20.x through 4.17.x (via xsa519-4.20-1.patch and xsa519-4.20-2.patch)</anitation> </invoke>
Technical details
CVE-2026-102702 is a logic error in GNTTABOP_cache_flush on Arm systems where the operation does not properly restrict invalidate-without-clean operations against read-only grant table mappings from other domains. An unprivileged guest can corrupt memory in another domain by issuing these operations, potentially enabling privilege escalation or information disclosure attacks.
Affected products
- Xen Hypervisor 4.5 through 4.21.x on Arm platforms
Timeline
- 2026-10-13: disclosed