CVE-2026-79609 (GCVE-0-2026-79609)
Vulnerability from cvelistv5
Published
2026-10-13 15:44
Modified
2026-10-20 17:34
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.
References
Impacted products
Vendor Product Version
Xen Xen Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:13:43.715Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-516.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-79609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T17:34:35.122730Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T17:34:39.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-516"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All versions of Xen with the XPTI work backported to are affected.  In\nupstream these are Xen 4.7.5 and onwards, Xen 4.8.3 and onwards, Xen 4.9.2\nand onwards, Xen 4.10.1 and onwards, and all major releases from 4.11\nonwards.\n\nOnly 64-bit PV guests can leverage the vulnerability.  HVM and PVH guests\ncannot leverage the vulnerability.  32-bit PV guests haven\u0027t been security\nsupported anymore.\n\nOnly x86 systems are affected.  Arm systems are not affected.\n\nOnly systems with RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) boundary\nare affected.  Systems with no RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5\nTiB) boundary are not affected."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by George Dunlap."
        }
      ],
      "datePublic": "2026-10-13T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown\n(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV\nguest page table entries from guest-chosen root page tables to the Xen-\nchosen one which is in actual use by hardware.  To read the guest root\npage table, the directmap is used.  PV guests, however, have a directmap\nwhich may not cover all memory; in particular this is the case if any\nmemory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address\nboundary."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A 64-bit PV guest may be able to elevate its privilege to that of the\nhost.  It is also possible for them to observe information pertaining to\nother guests, or to cause Denial of Service (DoS) affecting the entire\nhost."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T15:44:24.763Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-516.html"
        }
      ],
      "title": "x86: XPTI may break on huge-memory systems",
      "workarounds": [
        {
          "lang": "en",
          "value": "Not running 64-bit PV guests will avoid the vulnerability.\n\nThe \"mem=\" hypervisor command line option may be used to limit the amount\nof memory Xen is going to use.  That would be \"mem=5T\" for the\nCONFIG_BIGMEM=n case and \"mem=3584G\" for the CONFIG_BIGMEM=y one."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-79609",
    "datePublished": "2026-10-13T15:44:24.763Z",
    "dateReserved": "2026-08-25T07:35:05.289Z",
    "dateUpdated": "2026-10-20T17:34:39.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://xenbits.xen.org/xsa/advisory-516.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-10-13T16:13:43.715Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-79609\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-20T17:34:35.122730Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284 Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-20T17:34:09.234Z\"}}], \"cna\": {\"title\": \"x86: XPTI may break on huge-memory systems\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by George Dunlap.\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"A 64-bit PV guest may be able to elevate its privilege to that of the\\nhost.  It is also possible for them to observe information pertaining to\\nother guests, or to cause Denial of Service (DoS) affecting the entire\\nhost.\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-516\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2026-10-13T12:00:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-516.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Not running 64-bit PV guests will avoid the vulnerability.\\n\\nThe \\\"mem=\\\" hypervisor command line option may be used to limit the amount\\nof memory Xen is going to use.  That would be \\\"mem=5T\\\" for the\\nCONFIG_BIGMEM=n case and \\\"mem=3584G\\\" for the CONFIG_BIGMEM=y one.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown\\n(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV\\nguest page table entries from guest-chosen root page tables to the Xen-\\nchosen one which is in actual use by hardware.  To read the guest root\\npage table, the directmap is used.  PV guests, however, have a directmap\\nwhich may not cover all memory; in particular this is the case if any\\nmemory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address\\nboundary.\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"All versions of Xen with the XPTI work backported to are affected.  In\\nupstream these are Xen 4.7.5 and onwards, Xen 4.8.3 and onwards, Xen 4.9.2\\nand onwards, Xen 4.10.1 and onwards, and all major releases from 4.11\\nonwards.\\n\\nOnly 64-bit PV guests can leverage the vulnerability.  HVM and PVH guests\\ncannot leverage the vulnerability.  32-bit PV guests haven\u0027t been security\\nsupported anymore.\\n\\nOnly x86 systems are affected.  Arm systems are not affected.\\n\\nOnly systems with RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) boundary\\nare affected.  Systems with no RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5\\nTiB) boundary are not affected.\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2026-10-13T15:44:24.763Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-79609\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-20T17:34:39.462Z\", \"dateReserved\": \"2026-08-25T07:35:05.289Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2026-10-13T15:44:24.763Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.