Is CVE-2026-102702 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102702 being exploited in the wild.

How severe is CVE-2026-102702?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Xen Project Xen 4.5 through 4.20 and 4.21.x (Arm only).

Is there a fix for CVE-2026-102702?

Yes: fixed in Xen 4.20.x and 4.21.x via patches xsa519-4.20-1.patch, xsa519-4.20-2.patch, xsa519-1.patch, xsa519-2.patch. Until then: No mitigation is available; patching is required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102702 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-102702?

Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102702: Xen hypervisor cache flush denial of service and memory corruption

CVE-2026-102702 · Severity: info · Published 2026-10-13

Xen is a hypervisor that runs multiple isolated virtual machines on a single physical server. Two flaws in how guest operating systems can flush CPU caches on Arm-based systems allow a malicious unprivileged guest to crash the entire hypervisor or corrupt memory belonging to other guests. This can result in denial of service affecting all workloads on the host, or potentially enable privilege escalation and data theft.

Technologies: Xen Project Xen. Vendors: Xen Project.

Quick answers

Is CVE-2026-102702 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102702 being exploited in the wild.
How severe is CVE-2026-102702?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Xen Project Xen 4.5 through 4.20 and 4.21.x (Arm only).
Is there a fix for CVE-2026-102702?: Yes: fixed in Xen 4.20.x and 4.21.x via patches xsa519-4.20-1.patch, xsa519-4.20-2.patch, xsa519-1.patch, xsa519-2.patch. Until then: No mitigation is available; patching is required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102702 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-102702?: Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Xen 4.20.x and 4.21.x via patches xsa519-4.20-1.patch, xsa519-4.20-2.patch, xsa519-1.patch, xsa519-2.patch

No mitigation is available; patching is required.

Technical details

CVE-2026-102699: A calculation underflow in the GNTTABOP_cache_flush handler (introduced by a prior fix to XSA-437) causes an excessive-length loop on 64-bit Arm systems that crashes the hypervisor. CVE-2026-102702: No validation prevents invalidate-without-clean operations on read-only grant table mappings, allowing corruption of granted memory from another domain. Both require guest-level access via the grant table interface on Arm systems; x86 is unaffected.

Affected products

Xen Project Xen 4.5 through 4.20 and 4.21.x (Arm only)

Timeline

2026-10-13: disclosed

References

https://xenbits.xenproject.org/xsa/advisory-519.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.