Is CVE-2026-79610 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79610 being exploited in the wild.

How severe is CVE-2026-79610?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Xen 4.0 to 4.17.x (all versions from 4.0 onwards).

How is CVE-2026-79610 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-79610?

Check whether you run Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79610: Xen grant-table double version change race condition

CVE-2026-79610 · Severity: info · Published 2026-10-13

Xen is a hypervisor that isolates virtual machines from each other. A flaw in how Xen manages grant tables—a mechanism for memory sharing between virtual machines—allows an unprivileged guest operating system to escalate privileges to the host level, potentially compromising all workloads and data on the system. Information disclosure and denial of service are also possible.

Technologies: Xen. Vendors: Xen.

Quick answers

Is CVE-2026-79610 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79610 being exploited in the wild.
How severe is CVE-2026-79610?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Xen 4.0 to 4.17.x (all versions from 4.0 onwards).
Is there a fix for CVE-2026-79610?: No fixed version is recorded yet. Set the hypervisor command line option "gnttab=max-ver:1" or configure guests with "max_grant_version=1" to restrict grant table negotiation to version 1 and prevent exploitation. Alternatively, build Xen with CONFIG_GRANT_TABLE turned off. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-79610 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-79610?: Check whether you run Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Set the hypervisor command line option "gnttab=max-ver:1" or configure guests with "max_grant_version=1" to restrict grant table negotiation to version 1 and prevent exploitation. Alternatively, build Xen with CONFIG_GRANT_TABLE turned off.

Technical details

A race condition in Xen's grant table version negotiation causes stale pointers into the status array when a guest changes from version 2 to version 1 and back to version 2. During the first change, status pages are freed; during the second, they are reallocated at different addresses, leaving previously cached pointers invalid. This affects x86 guests with multi-vCPU configurations that use grant table version 2 interfaces. An unprivileged guest can exploit this to gain hypervisor-level access.

Affected products

Xen Xen 4.0 to 4.17.x (all versions from 4.0 onwards)

Timeline

2026-10-13: disclosed
2026-10-13: advisory: XSA-517 publicly released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.