Is CVE-2026-79603 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79603 being exploited in the wild.

How severe is CVE-2026-79603?

Medium severity, with a CVSS score of 4.3, published 8 September 2026.

Is there a fix for CVE-2026-79603?

A patch was published on 2026-09-08: Patches released for Xen 4.18–4.22 and unstable branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79603 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-79603?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79603: Xen TLB flush race condition allowing stale page modification

CVE-2026-79603 · Severity: medium · CVSS 4.3 · Published 2026-09-08

Xen is a virtualization platform that manages hardware resources for multiple guest operating systems. A race condition in x86 PV (paravirtual) guests allows a guest to modify memory pages that have been freed and logically scrubbed, potentially bypassing information isolation controls between guests. This undermines security deployments using silo-mode isolation with memory scrubbing.

Quick answers

Is CVE-2026-79603 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79603 being exploited in the wild.
How severe is CVE-2026-79603?: Medium severity, with a CVSS score of 4.3, published 8 September 2026.
Which products and versions are affected?: Xen Xen 4.13 through 4.22.
Is there a fix for CVE-2026-79603?: A patch was published on 2026-09-08: Patches released for Xen 4.18–4.22 and unstable branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79603 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-79603?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a TLB (Translation Lookaside Buffer) flush race condition affecting x86 PV guests. When a guest frees memory pages, Xen defers TLB flushing until page re-use. However, the scrubbing of freed pages can occur before the delayed TLB flush, creating a window where a PV guest can modify already-scrubbed pages via stale TLB entries. This bypasses the isolation intended by `xsm=silo scrub-domheap` configurations. The vulnerability requires Xen 4.13 or later; exploitation is limited to x86 PV guests (not HVM or PVH). Patches are available for all affected versions (4.13 through 4.22).

Affected products

Xen Xen 4.13 through 4.22

Timeline

2026-09-08: disclosed
2026-09-08: patched: Patches released for Xen 4.18–4.22 and unstable branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.