VSA-2026-047: VMX VMentry failure with branch tracing and blocked states (CVE-2026-79611 / XSA-518)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-10-13 | 2026-10-13 | 🟠Moderate | Not available yet | - XCP-ng 8.3 |
A vulnerability in the Xen hypervisor's VMX handling has been discovered. For Vates products, we classify the impact as Moderate. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
For XSA-308 logic was introduced because VMX VMEntry checks do not like the exact state combination of intercepted #DB, active Single Stepping, and blocked by STI/MovSS, despite it being legitimate; the resulting VMEntry failure is fatal to the guest. There is another special sub-case with branch tracing enabled, in which the prior adjustment still causes a VMentry failure, again fatal to the guest.
Impact​
HVM/PVH guest userspace code may be able to crash the guest, resulting in a guest Denial of Service. The host and other domains are not affected.
Status​
- Released
Affected Versions​
- XCP-ng 8.3: Affected on systems with VMX hardware virtual extensions (Intel, VIA or Zhaoxin CPUs).
Mitigation​
Running HVM guests only on AMD or Hygon hardware, avoids this issue.
Resolution​
As of 2026-10-13, the xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
xen-4.17.7-2.5.xcpng8.3