VSA-2026-028: grant-table version change racing with other operations (CVE-2026-62435, CVE-2026-62436 / XSA-501)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-07-28 | 2026-07-28 | 🔴 Important | Not available yet | - XCP-ng 8.3 |
A vulnerability in the Xen hypervisor's grant-table version switching mechanism has been discovered. For Vates products, we classify the impact as Important, as an unprivileged guest may be able to elevate its privileges to that of the host. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
With the introduction of Grant Table v2, Xen gained the ability to switch between versions at runtime. Switching from v1 to v2 reduces the number of valid grant references, as a bigger shared entry structure is then needed while the shared table doesn't change size. Switching from v2 back to v1 means the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant table lock, sometimes wrongly assumes that said properties wouldn't change across the window in time where the lock is not being held. The v1 to v2 issue is CVE-2026-62435. The v2 to v1 issue is CVE-2026-62436.
Impact​
An unprivileged guest may be able to elevate its privileges to that of the host. Information leaks and Denial of Service (DoS) are possible as well.
Affected Versions​
- XCP-ng 8.3: Affected, only guests using multi-vCPU are able to leverage this vulnerability.
Mitigation​
Using the Xen command-line option gnttab=max-ver:1 will mitigate this issue.
Resolution​
As of 2026-07-28, the updated xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
4.17.6-9.3.1.xcpng8.3