Xen Project (13 Oct): eight hypervisor advisories, XSA-514 to XSA-521, including guest-to-host privilege escalation through a grant-table race (CVE-2026-79610), a broken Zenbleed workaround on AMD Zen 2 (CVE-2026-79608) and an Arm cache-flush host crash; patches out, downstream updates to follow
The Xen Project published eight security advisories on 13 October 2026 (12:00 UTC). The most serious for shared hosting is XSA-517 (CVE-2026-79610): a race in grant-table version changes lets an unprivileged x86 guest that can use grant table v2 and has more than one vCPU possibly escalate to host privileges, leak information or crash the host; every Xen release from 4.0 onward is affected. XSA-516 (CVE-2026-79609) is a page-table isolation (XPTI) flaw that lets a 64-bit PV guest escalate to the host, but only on x86 hosts with RAM above the 5 TiB boundary (3.5 TiB with CONFIG_BIGMEM). XSA-515 (CVE-2026-79608) says a rework of the Zenbleed workaround left it ineffective on AMD Zen 2 CPUs, so code can read data from other contexts on the same core, such as AES-NI key material and memcpy contents; it affects Xen 4.19.4 and later, 4.20.3 and later, 4.21.1 and later and 4.22, and only systems still running pre-Zenbleed (2023) microcode. XSA-519 (CVE-2026-102699 and CVE-2026-102702) lets a malicious guest on Arm crash the hypervisor or corrupt another domain's memory through GNTTABOP_cache_flush, with privilege escalation not ruled out and no mitigation, on Xen 4.5 onward. XSA-521 (CVE-2026-102701) is a missing bounds check in tapdisk, the userspace block backend used by the XAPI toolstack, which a malicious guest can use to overflow the stack and possibly run code as root. The rest are denial-of-service issues: XSA-514 (CVE-2026-79607) crashes C xenstored during a Xenstore live update on Xen 4.22, XSA-518 (CVE-2026-79611) lets HVM or PVH guest userspace crash its own guest on Intel VMX hosts, and XSA-520 (CVE-2026-102700) leaks page references through x86 cache-flush handling on Xen 4.5 to 4.20. The Xen Project does not assign CVSS scores and reports no exploitation. Primary: Xen Project security advisories.
- Product
- Xen hypervisor (x86 and Arm), C xenstored, and blktap/tapdisk (XAPI toolstack)
- Versions
- XSA-517: Xen 4.0 onward (x86, grant table v2 guests). XSA-516: Xen 4.7.5 onward with XPTI, x86 hosts with more than 5 TiB RAM. XSA-515: 4.19.4+, 4.20.3+, 4.21.1+ and 4.22 on AMD Zen 2 with old microcode. XSA-519: Xen 4.5 onward on Arm. XSA-520: Xen 4.5 to 4.20 on x86. XSA-514: Xen 4.22 with C xenstored. XSA-518: all versions on Intel/VMX. XSA-521: all tapdisk versions. Patches are published for the supported branches (4.17 to 4.22 and blktap master).
- Exploited in Australia?
- unknown
- Patch to
- Apply the XSA-514 to XSA-521 patches, or your distribution's or appliance vendor's Xen and blktap updates once they ship, then reboot hosts. Until patched, booting with gnttab=max-ver:1 (or max_grant_version=1 per guest) blocks XSA-517, and mem=5T (mem=3584G with CONFIG_BIGMEM) avoids XSA-516. For XSA-515, load current AMD microcode; disabling AVX also works but costs performance. There is no mitigation for the Arm XSA-519 or the tapdisk XSA-521, so prioritise hosts running untrusted guests.
Primary: Xen Project — Security advisories XSA-514 to XSA-521 (13 Oct 2026) · Vendor: Xen Project — XSA-517 / CVE-2026-79610: grant-table double version change race · CVE: CVE-2026-79610, CVE-2026-79608, CVE-2026-79609, CVE-2026-102699, CVE-2026-102702, CVE-2026-102701, CVE-2026-79607, CVE-2026-79611, CVE-2026-102700 · Xen Project — XSA-515 / CVE-2026-79608: ineffectual Zenbleed workaround