Executive brief
Xen is a virtualization platform that manages hardware resources for multiple guest operating systems. A race condition in x86 PV (paravirtual) guests allows a guest to modify memory pages that have been freed and logically scrubbed, potentially bypassing information isolation controls between guests. This undermines security deployments using silo-mode isolation with memory scrubbing.
Technical details
The vulnerability is a TLB (Translation Lookaside Buffer) flush race condition affecting x86 PV guests. When a guest frees memory pages, Xen defers TLB flushing until page re-use. However, the scrubbing of freed pages can occur before the delayed TLB flush, creating a window where a PV guest can modify already-scrubbed pages via stale TLB entries. This bypasses the isolation intended by `xsm=silo scrub-domheap` configurations. The vulnerability requires Xen 4.13 or later; exploitation is limited to x86 PV guests (not HVM or PVH). Patches are available for all affected versions (4.13 through 4.22).
Affected products
- Xen Xen 4.13 through 4.22
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patches released for Xen 4.18–4.22 and unstable branch