Is CVE-2026-79609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79609 being exploited in the wild.

How severe is CVE-2026-79609?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Xen Project Xen 4.7.5 and later, 4.8.3 and later, 4.9.2 and later, 4.10.1 and later, and all 4.11+.

How is CVE-2026-79609 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-79609?

Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79609: Xen XPTI privilege escalation on huge-memory systems

CVE-2026-79609 · Severity: info · Published 2026-10-13

Xen is a hypervisor that isolates virtual machines from each other and the host. A flaw in Xen's page table isolation feature can allow a 64-bit guest operating system to take control of the host, access other guests' data, or crash the entire system—but only on systems with more than 5 TB of RAM and only if running older paravirtualized guests.

Technologies: Xen Project Xen. Vendors: Xen Project.

Quick answers

Is CVE-2026-79609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79609 being exploited in the wild.
How severe is CVE-2026-79609?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Xen Project Xen 4.7.5 and later, 4.8.3 and later, 4.9.2 and later, 4.10.1 and later, and all 4.11+.
Is there a fix for CVE-2026-79609?: Yes: fixed in Xen 4.19.x (xsa516.patch), Xen 4.18.x (xsa516-4.18.patch), Xen 4.17.x (xsa516-4.17.patch). Until then: Do not run 64-bit PV guests. Alternatively, use the "mem=" hypervisor command-line option to limit Xen's memory usage to 5T (CONFIG_BIGMEM=n) or 3584G (CONFIG_BIGMEM=y). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79609 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-79609?: Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Xen 4.19.x (xsa516.patch), Xen 4.18.x (xsa516-4.18.patch), Xen 4.17.x (xsa516-4.17.patch)

Do not run 64-bit PV guests. Alternatively, use the "mem=" hypervisor command-line option to limit Xen's memory usage to 5T (CONFIG_BIGMEM=n) or 3584G (CONFIG_BIGMEM=y).

Technical details

The XPTI (Xen Page Table Isolation) feature, introduced to mitigate Meltdown, relies on a directmap to copy guest page table entries. On systems with RAM extending beyond 5 TB (or 3.5 TB with CONFIG_BIGMEM), the directmap does not cover all memory, allowing a 64-bit PV guest to read unmapped guest-chosen page tables and gain host-level privileges. HVM and PVH guests are unaffected; only x86 systems with huge RAM configurations are vulnerable.

Affected products

Xen Project Xen 4.7.5 and later, 4.8.3 and later, 4.9.2 and later, 4.10.1 and later, and all 4.11+

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.