Executive brief
A race condition exists in the Xen hypervisor, which is software used to run multiple virtual machines on a single physical server. An attacker controlling a guest virtual machine could exploit this flaw to potentially crash the entire host server, access data from other virtual machines, or gain elevated control over the physical hardware. This poses a significant risk to multi-tenant environments like cloud service providers where isolation between users is critical.
Technical details
A race condition exists in Xen when an x86 HVM or PVH guest performs a grant table version change from v2 to v1 simultaneously with mapping status pages via XENMEM_add_to_physmap. This timing window allows some status pages to be freed while their mappings remain in the guest's secondary (P2M) page tables. An attacker with control over a guest VM can leverage this use-after-free scenario to achieve privilege escalation, information disclosure, or a host-wide Denial of Service (DoS). The vulnerability affects x86 systems where grant table v2 is enabled; ARM and x86 PV guests are not affected. Patches are available for Xen versions 4.17 through 4.19, and a mitigation exists by restricting guests to grant table version 1.
Affected products
- Xen Project Xen 4.0 through 4.19.x
Timeline
- 2026-04-28: disclosed: Initial public release of XSA-486
- 2026-05-19: advisory: NVD publication date