# CVE-2026-79610: Xen grant-table double version change race condition

Source: https://junglewise.ai/threats/cve-2026-79610-xsa-501-was-about-issues-with-v1-v2-and-v2-v1-changes-racing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-79610 · Severity: info · Published 2026-10-13

Xen is a hypervisor that isolates virtual machines from each other. A flaw in how Xen manages grant tables—a mechanism for memory sharing between virtual machines—allows an unprivileged guest operating system to escalate privileges to the host level, potentially compromising all workloads and data on the system. Information disclosure and denial of service are also possible.

Technologies: [Xen](https://junglewise.ai/threats/technologies/xen-xen). Vendors: [Xen](https://junglewise.ai/threats/vendors/xen).

## Quick answers

**Is CVE-2026-79610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79610 being exploited in the wild.

**How severe is CVE-2026-79610?** Informational severity, published 13 October 2026.

**Which products and versions are affected?** Xen 4.0 to 4.17.x (all versions from 4.0 onwards).

**Is there a fix for CVE-2026-79610?** No fixed version is recorded yet. Set the hypervisor command line option "gnttab=max-ver:1" or configure guests with "max_grant_version=1" to restrict grant table negotiation to version 1 and prevent exploitation. Alternatively, build Xen with CONFIG_GRANT_TABLE turned off. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79610 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-79610?** Check whether you run Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Set the hypervisor command line option "gnttab=max-ver:1" or configure guests with "max_grant_version=1" to restrict grant table negotiation to version 1 and prevent exploitation. Alternatively, build Xen with CONFIG_GRANT_TABLE turned off.

## Technical details

A race condition in Xen's grant table version negotiation causes stale pointers into the status array when a guest changes from version 2 to version 1 and back to version 2. During the first change, status pages are freed; during the second, they are reallocated at different addresses, leaving previously cached pointers invalid. This affects x86 guests with multi-vCPU configurations that use grant table version 2 interfaces. An unprivileged guest can exploit this to gain hypervisor-level access.

## Affected products

- Xen Xen 4.0 to 4.17.x (all versions from 4.0 onwards)

## Timeline

- 2026-10-13: disclosed
- 2026-10-13: advisory: XSA-517 publicly released

## References

- [https://xenbits.xenproject.org/xsa/advisory-517.html](https://xenbits.xenproject.org/xsa/advisory-517.html)
- [http://www.openwall.com/lists/oss-security/2026/10/13/6](http://www.openwall.com/lists/oss-security/2026/10/13/6)

## Related threats

- [Xen Xenstore crash during live update with watch depth](https://junglewise.ai/threats/cve-2026-79607-during-xenstore-live-update-the-state-record-for-a-xenstore-watch)
- [When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have.](https://junglewise.ai/threats/cve-2025-58149-when-passing-through-pci-devices-the-detach-logic-in-libxl-won-t)
- [[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…](https://junglewise.ai/threats/cve-2025-58148-this-cna-information-record-relates-to-multiple-cves-the-text)
- [[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…](https://junglewise.ai/threats/cve-2025-58147-this-cna-information-record-relates-to-multiple-cves-the-text)