# CVE-2026-79611: Xen VMX VMentry failure with branch tracing and blocked states

Source: https://junglewise.ai/threats/cve-2026-79611-for-xsa-308-logic-was-introduced-as-vmx-vmentry-checks-do-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-79611 · Severity: info · Published 2026-10-13

Xen is a virtualization platform that runs multiple guest operating systems on a single physical host. A flaw in Xen's handling of Intel VMX processor states causes guest virtual machines to crash when specific processor debug and branch-tracing conditions occur simultaneously. An attacker with code execution in an HVM or PVH guest can trigger this crash, resulting in a denial of service against that guest system.

Technologies: [Xen Project Xen](https://junglewise.ai/threats/technologies/xen). Vendors: [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2026-79611 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79611 being exploited in the wild.

**How severe is CVE-2026-79611?** Informational severity, published 13 October 2026.

**Which products and versions are affected?** Xen Project Xen All versions; specifically Xen 4.17.x through 4.21.x receive patches.

**Is there a fix for CVE-2026-79611?** Yes: fixed in Xen 4.21.x (xsa518.patch), Xen 4.20.x through 4.17.x (xsa518-4.20.patch). Until then: Running only PV guests will avoid this vulnerability. Running HVM guests exclusively on AMD or Hygon hardware will also avoid this vulnerability, as they do not support Intel VMX. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79611 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-79611?** Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Xen 4.21.x (xsa518.patch), Xen 4.20.x through 4.17.x (xsa518-4.20.patch)

Running only PV guests will avoid this vulnerability. Running HVM guests exclusively on AMD or Hygon hardware will also avoid this vulnerability, as they do not support Intel VMX.

## Technical details

The vulnerability exists in Xen's VMX (Intel Virtual Machine Extensions) entry logic when handling a combination of debug exceptions (#DB), single-stepping, branch tracing, and STI/MovSS blocking. The prior XSA-308 fix did not account for branch-tracing as a special sub-case, causing VMentry failures that are fatal to the guest. HVM and PVH guest userspace code can trigger this condition; PV guests and AMD/Hygon systems are unaffected. Patches are available for Xen 4.17.x through 4.21.x.

## Affected products

- Xen Project Xen All versions; specifically Xen 4.17.x through 4.21.x receive patches

## Timeline

- 2026-10-13: disclosed

## References

- [https://xenbits.xenproject.org/xsa/advisory-518.html](https://xenbits.xenproject.org/xsa/advisory-518.html)
- [http://www.openwall.com/lists/oss-security/2026/10/13/7](http://www.openwall.com/lists/oss-security/2026/10/13/7)

## Related threats

- [Xen arbitrary read/write via grant copy caching](https://junglewise.ai/threats/cve-2026-102704-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen hypervisor arbitrary read/write via grant copy](https://junglewise.ai/threats/cve-2026-102703-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen XPTI privilege escalation on huge-memory systems](https://junglewise.ai/threats/cve-2026-79609-xpti-xen-page-table-isolation-was-introduced-to-mitigate-meltdown)
- [Xen ineffectual Zenbleed workaround on AMD x86](https://junglewise.ai/threats/cve-2026-79608-the-workaround-for-xsa-433-zenbleed-was-later-re-worked-to-better)
- [Xen hypervisor cache flush denial of service and memory corruption](https://junglewise.ai/threats/cve-2026-102702-this-cna-information-record-relates-to-multiple-cves-the-text)