VSA-2026-039: Out-of-bounds accesses in Tapdisk (CVE-2026-79605, CVE-2026-79606 / XSA-513)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-09-08 | 2026-09-08 | ⚫ Critical | Not available yet | - XCP-ng 8.3 |
A vulnerability in tapdisk, the userspace xen-blkback implementation used by the XAPI toolstack, has been discovered. For Vates products, we classify the impact as Critical, as a malicious guest can obtain code execution within the tapdisk process running in dom0, which normally runs as root. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary
Tapdisk is a userspace xen-blkback implementation used by the XAPI toolstack. Several bounds checks have been found to be incorrect.
- There is no upper bounds check for blkif->last_sect. Passing a value larger than 7 will result in a read or write beyond the mapped grant. This is CVE-2026-79605.
- The gcopy_segs[] object has incorrect bounds checks on it. Passing nr_segments between 12 and 32 will corrupt adjacent memory. This is CVE-2026-79606.
Impact
A malicious guest can obtain code execution within the tapdisk process running in dom0. Tapdisk normally runs as root.
Status
- 2026-09-08: Released
Affected Versions
- XCP-ng 8.3: Affected.
Mitigation
There are no known mitigations.
Resolution
As of 2026-09-08, the blktap package for XCP-ng 8.3 has been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
blktap-0:3.55.5-9.5.xcpng8.3