VSA-2026-046: grant-table double version change race (CVE-2026-79610 / XSA-517)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-10-13 | 2026-10-13 | 🔴 Important | Not available yet | - XCP-ng 8.3 |
A vulnerability in the Xen hypervisor's grant-table version switching mechanism has been discovered. For Vates products, we classify the impact as Important. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
Follow-up to XSA-501: a v2 -> v1 -> v2 grant table version change has a further effect which was not accounted for. During the first change the status pages are freed, during the second they are allocated again, so across the full pair the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.
Impact​
An unprivileged guest may be able to elevate its privileges to that of the host. Information leaks and Denial of Service (DoS) are possible as well.
Status​
- Released
Affected Versions​
- XCP-ng 8.3: Affected, only x86 guests permitted to use grant table version 2 interfaces, and only multi-vCPU guests.
Mitigation​
Using the Xen command-line option gnttab=max-ver:1 (or the guest configuration option max_grant_version=1) disables grant table version 2 and mitigates this issue.
Resolution​
As of 2026-10-13, the xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
xen-4.17.7-2.5.xcpng8.3