Two Xen hypervisor flaws let a malicious VM read and write other VMs' memory
Patches exist for some Xen releases, but versions 4.6 through 4.16 have no published fix and no mitigation is available.
Two newly disclosed flaws in the Xen hypervisor, tracked as CVE-2026-102703 and CVE-2026-102704 under advisory XSA-523, let a malicious guest VM read and write memory belonging to other VMs on the same host, including dom0. The Xen Project said on November 3 that patches are available and no mitigation exists, and that every release from 4.6 onward is affected while 4.5 and earlier are not. The bugs sit in the grant copy mechanism: Xen reused earlier permission checks for batched copies within one memory page and sometimes skipped re-checking when it should have. Anthropic was credited with the discovery via its Claude model, with Ada Logics validating it and CodeAnt AI independently reporting it. Downstream platforms are moving quickly: XCP-ng 8.3 shipped a fixed build with a required host reboot, Qubes OS 4.3 shipped Xen 4.19.6-3 packages, and Debian still listed several releases as vulnerable as of November 4. Versions 4.6 through 4.16 have no published patch, and 4.16 is out of security support.
Why it matters
Any Xen host running a guest the operator does not fully trust is exposed, because one malicious guest can reach the memory of every other VM on the machine, including dom0. Operators on Xen 4.17 and later can apply patches now and must reboot hosts to finish, while those on 4.6 through 4.16 have no published fix. Since 4.16 is also out of security support, those hosts are left with no route to an official patch and no mitigation to fall back on.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.