Is CVE-2026-102700 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102700 being exploited in the wild.

How severe is CVE-2026-102700?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Xen Project Xen 4.5 through 4.20.

Is there a fix for CVE-2026-102700?

Yes: fixed in Xen 4.21 and newer; patches available for Xen 4.17 through 4.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102700 attacked?

It is attacked over the network or from the adjacent network, in an operating system.

Am I affected by CVE-2026-102700?

Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102700: Xen gnttab cache-flush page reference leak

CVE-2026-102700 · Severity: info · Published 2026-10-13

Xen is a hypervisor that manages virtual machines on a physical server. A flaw in the grant-table cache-flush handler fails to properly release memory page references for special system domains, causing a memory leak that can crash a virtual machine or the entire host. This is a denial-of-service vulnerability that requires no special privileges to trigger.

Technologies: Xen Project Xen. Vendors: Xen Project.

Quick answers

Is CVE-2026-102700 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102700 being exploited in the wild.
How severe is CVE-2026-102700?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Xen Project Xen 4.5 through 4.20.
Is there a fix for CVE-2026-102700?: Yes: fixed in Xen 4.21 and newer; patches available for Xen 4.17 through 4.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102700 attacked?: It is attacked over the network or from the adjacent network, in an operating system.
Am I affected by CVE-2026-102700?: Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Xen 4.21 and newer; patches available for Xen 4.17 through 4.20

Technical details

The GNTTAB_cache_flush operation has an error path that fails to decrement a page reference when the target page belongs to a special system domain (DOM_IO or DOM_COW). This causes a reference-counting leak. The vulnerability exists in the grant-table code on x86-only systems; attack vectors include unprivileged guest domains making cache-flush calls, leading to denial of service of Domain 0 or peer domains.

Affected products

Xen Project Xen 4.5 through 4.20

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.