VSA-2026-048: gnttab cache-flush handling may cause a page reference leak (CVE-2026-102700 / XSA-520)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-10-13 | 2026-10-13 | 🔴 Important | Not available yet | - XCP-ng 8.3 |
A vulnerability in the Xen hypervisor's grant-table cache-flush handling has been discovered. For Vates products, we classify the impact as Important. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
GNTTABOP_cache_flush was originally made available uniformly; XSA-232 (CVE-2017-14318) covered an omitted NULL pointer check, but adding that check failed to adjust the subsequent error path, which fails to drop a page reference when the specified page is owned by a special system domain (DOM_IO and DOM_COW).
Impact​
The most likely outcome is a Denial of Service of Domain 0 (then likely affecting the entire host) or of another domain.
Status​
- Released
Affected Versions​
- XCP-ng 8.3: Affected.
Mitigation​
There is no known mitigation.
Resolution​
As of 2026-10-13, the xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
xen-4.17.7-2.5.xcpng8.3