VSA-2026-027: grant-table type confusion in grant-copy (CVE-2026-62428 / XSA-500)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-07-28 | 2026-07-28 | ⚫ Critical | Not available yet | - XCP-ng 8.3 |
A vulnerability in the Xen hypervisor's grant-table implementation has been discovered. For Vates products, we classify the impact as Critical, as an unprivileged guest may be able to elevate its privileges to that of the host. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary
When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations, the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and the copy operation may not be consistent: the permission check may be carried out on a page different from the one involved in the copy operation.
Impact
An unprivileged guest may be able to elevate its privileges to that of the host. Information leaks and Denial of Service (DoS) are possible as well.
Affected Versions
- XCP-ng 8.3: Affected.
Mitigation
There is no known mitigation.
Resolution
As of 2026-07-28, the updated xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
4.17.6-9.3.1.xcpng8.3
Credits
This issue was discovered by Roman S.