Is CVE-2026-79611 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79611 being exploited in the wild.

How severe is CVE-2026-79611?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Xen Project Xen All versions; specifically Xen 4.17.x through 4.21.x receive patches.

How is CVE-2026-79611 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-79611?

Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79611: Xen VMX VMentry failure with branch tracing and blocked states

CVE-2026-79611 · Severity: info · Published 2026-10-13

Xen is a virtualization platform that runs multiple guest operating systems on a single physical host. A flaw in Xen's handling of Intel VMX processor states causes guest virtual machines to crash when specific processor debug and branch-tracing conditions occur simultaneously. An attacker with code execution in an HVM or PVH guest can trigger this crash, resulting in a denial of service against that guest system.

Technologies: Xen Project Xen. Vendors: Xen Project.

Quick answers

Is CVE-2026-79611 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79611 being exploited in the wild.
How severe is CVE-2026-79611?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Xen Project Xen All versions; specifically Xen 4.17.x through 4.21.x receive patches.
Is there a fix for CVE-2026-79611?: Yes: fixed in Xen 4.21.x (xsa518.patch), Xen 4.20.x through 4.17.x (xsa518-4.20.patch). Until then: Running only PV guests will avoid this vulnerability. Running HVM guests exclusively on AMD or Hygon hardware will also avoid this vulnerability, as they do not support Intel VMX. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79611 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-79611?: Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Xen 4.21.x (xsa518.patch), Xen 4.20.x through 4.17.x (xsa518-4.20.patch)

Running only PV guests will avoid this vulnerability. Running HVM guests exclusively on AMD or Hygon hardware will also avoid this vulnerability, as they do not support Intel VMX.

Technical details

The vulnerability exists in Xen's VMX (Intel Virtual Machine Extensions) entry logic when handling a combination of debug exceptions (#DB), single-stepping, branch tracing, and STI/MovSS blocking. The prior XSA-308 fix did not account for branch-tracing as a special sub-case, causing VMentry failures that are fatal to the guest. HVM and PVH guest userspace code can trigger this condition; PV guests and AMD/Hygon systems are unaffected. Patches are available for Xen 4.17.x through 4.21.x.

Affected products

Xen Project Xen All versions; specifically Xen 4.17.x through 4.21.x receive patches

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.