VSA-2026-049: Out-of-bounds access in tapdisk (CVE-2026-102701 / XSA-521)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-10-13 | 2026-10-13 | ⚫ Critical | Not available yet | - XCP-ng 8.3 |
A vulnerability in tapdisk, the userspace xen-blkback implementation used by the XAPI toolstack, has been discovered. For Vates products, we classify the impact as Critical. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary
Tapdisk is the userspace xen-blkback implementation used by the XAPI toolstack. During connection, multi-page rings may be negotiated between frontend and backend, but tapdisk had no boundary check on the size requested by the frontend and assumed it did not exceed 8.
Impact
A buggy or malicious guest can cause a stack overflow in tapdisk, potentially leading to code execution. Tapdisk normally runs as root.
Status
- Released
Affected Versions
- XCP-ng 8.3: Affected, all versions of tapdisk.
Mitigation
There are no known mitigations.
Resolution
As of 2026-10-13, the blktap package for XCP-ng 8.3 has been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
- blktap-3.55.5-11.3.xcpng8.3