Is CVE-2026-79608 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79608 being exploited in the wild.

How severe is CVE-2026-79608?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Xen Project Xen 4.19.4 and onwards, 4.20.3 and onwards, 4.21.1 and onwards, and 4.22.

How is CVE-2026-79608 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-79608?

Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79608: Xen ineffectual Zenbleed workaround on AMD x86

CVE-2026-79608 · Severity: info · Published 2026-10-13

Xen, a virtualization platform used to run multiple isolated systems on a single server, contains a broken workaround for an AMD processor flaw (Zenbleed) that allows attackers to leak sensitive data between virtual machines sharing the same processor core. An attacker with access to a guest VM could read encryption keys, cryptographic intermediate values, or other confidential data from adjacent VMs through a logic error in the security fix.

Technologies: Xen Project Xen. Vendors: Xen Project.

Quick answers

Is CVE-2026-79608 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79608 being exploited in the wild.
How severe is CVE-2026-79608?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Xen Project Xen 4.19.4 and onwards, 4.20.3 and onwards, 4.21.1 and onwards, and 4.22.
Is there a fix for CVE-2026-79608?: Yes: fixed in Xen 4.19.x patched versions, 4.20 patched versions, 4.21 patched versions (see xsa515.patch). Until then: Disable AVX by booting Xen with `cpuid=no-avx` on the command line, or specify `cpuid="host:avx=0"` in the vm.cfg file of untrusted VMs; however, this carries significant performance impact and is not recommended if microcode updates are available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79608 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-79608?: Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Xen 4.19.x patched versions, 4.20 patched versions, 4.21 patched versions (see xsa515.patch)

Disable AVX by booting Xen with `cpuid=no-avx` on the command line, or specify `cpuid="host:avx=0"` in the vm.cfg file of untrusted VMs; however, this carries significant performance impact and is not recommended if microcode updates are available.

Technical details

An inverted conditional in the reworked Zenbleed mitigation code causes the workaround to be skipped when it should apply and applied when it should not, allowing cross-context data leakage on AMD Zen2 processors. The vulnerability affects Xen versions 4.19.4+, 4.20.3+, 4.21.1+, and 4.22; exploitation requires out-of-date CPU microcode (pre-late 2023) and depends on attacker VM access. A patch resolves the conditional logic error.

Affected products

Xen Project Xen 4.19.4 and onwards, 4.20.3 and onwards, 4.21.1 and onwards, and 4.22

Timeline

2026-10-13: disclosed: Public release of XSA-515

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.