# CVE-2026-102700: Xen gnttab cache-flush page reference leak

Source: https://junglewise.ai/threats/cve-2026-102700-with-its-original-introduction-gnttab-cache-flush-was-made  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-102700 · Severity: info · Published 2026-10-13

Xen is a hypervisor that manages virtual machines on a physical server. A flaw in the grant-table cache-flush handler fails to properly release memory page references for special system domains, causing a memory leak that can crash a virtual machine or the entire host. This is a denial-of-service vulnerability that requires no special privileges to trigger.

Technologies: [Xen Project Xen](https://junglewise.ai/threats/technologies/xen). Vendors: [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2026-102700 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102700 being exploited in the wild.

**How severe is CVE-2026-102700?** Informational severity, published 13 October 2026.

**Which products and versions are affected?** Xen Project Xen 4.5 through 4.20.

**Is there a fix for CVE-2026-102700?** Yes: fixed in Xen 4.21 and newer; patches available for Xen 4.17 through 4.20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102700 attacked?** It is attacked over the network or from the adjacent network, in an operating system.

**Am I affected by CVE-2026-102700?** Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Xen 4.21 and newer; patches available for Xen 4.17 through 4.20

## Technical details

The GNTTAB_cache_flush operation has an error path that fails to decrement a page reference when the target page belongs to a special system domain (DOM_IO or DOM_COW). This causes a reference-counting leak. The vulnerability exists in the grant-table code on x86-only systems; attack vectors include unprivileged guest domains making cache-flush calls, leading to denial of service of Domain 0 or peer domains.

## Affected products

- Xen Project Xen 4.5 through 4.20

## Timeline

- 2026-10-13: disclosed

## References

- [https://xenbits.xenproject.org/xsa/advisory-520.html](https://xenbits.xenproject.org/xsa/advisory-520.html)
- [http://xenbits.xen.org/xsa/advisory-520.html](http://xenbits.xen.org/xsa/advisory-520.html)

## Related threats

- [Xen arbitrary read/write via grant copy caching](https://junglewise.ai/threats/cve-2026-102704-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen hypervisor arbitrary read/write via grant copy](https://junglewise.ai/threats/cve-2026-102703-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen VMX VMentry failure with branch tracing and blocked states](https://junglewise.ai/threats/cve-2026-79611-for-xsa-308-logic-was-introduced-as-vmx-vmentry-checks-do-not)
- [Xen XPTI privilege escalation on huge-memory systems](https://junglewise.ai/threats/cve-2026-79609-xpti-xen-page-table-isolation-was-introduced-to-mitigate-meltdown)
- [Xen ineffectual Zenbleed workaround on AMD x86](https://junglewise.ai/threats/cve-2026-79608-the-workaround-for-xsa-433-zenbleed-was-later-re-worked-to-better)