Executive brief
A vulnerability exists in the Xen hypervisor, which is software used to run multiple virtual machines on a single physical server. A malicious user in a virtual machine could trigger a memory management error that crashes the host server or potentially allows them to access data from other users. This issue only affects systems using the 'Populate on Demand' feature, typically used to over-provision memory.
Technical details
A vulnerability in Xen's Populate on Demand (PoD) mechanism allows an x86 HVM or PVH guest to attempt to reclaim pages that are not regular guest RAM. This occurs when a guest is configured with a 'maxmem' value larger than its initial 'memory' allocation. By targeting special pages for reclamation, a malicious guest can corrupt the hypervisor's internal memory management state. This can lead to a Denial of Service (host crash), information leakage, or potential privilege escalation. The issue affects all Xen versions from 3.4 onwards on x86 architectures. A patch is available via XSA-507.
Affected products
- Xen Project Xen 3.4 and later
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched