CVE-2026-23553

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23553", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-01-14T13:07:36.961Z", "datePublished": "2026-01-28T15:33:44.782Z", "dateUpdated": "2026-01-28T16:41:14.803Z"}, "containers": {"cna": {"title": "x86: incomplete IBPB for vCPU isolation", "datePublic": "2026-01-27T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks. Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A. Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Guest processes may leverage information leaks to obtain information\nintended to be private to other entities in a guest."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-479"}]}], "configurations": [{"lang": "en", "value": "Xen versions which had the XSA-254 fixes backported are vulnerable.\nUpstream, that is 4.6 and newer.\n\nOnly x86 systems are vulnerable. Arm systems are not vulerable.\n\nSystems vulnerable to SRSO (see XSA-434) with default settings use\nIBPB-on-entry to protect against SRSO. This is a rather more aggressive\nform of flushing than only on context switch, and is believed to be\nsufficient to avoid the vulnerability."}], "workarounds": [{"lang": "en", "value": "Using \"spec-ctrl=ibpb-entry=hvm,ibpb-entry=pv\" on the Xen command line\nwill activate the SRSO mitigation on non-SRSO-vulnerable hardware, but\nit is a large overhead."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by David Kaplan of AMD."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-479.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-01-28T15:33:44.782Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/01/27/3"}, {"url": "http://xenbits.xen.org/xsa/advisory-479.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-28T16:12:31.841Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-665", "lang": "en", "description": "CWE-665 Improper Initialization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-693", "lang": "en", "description": "CWE-693 Protection Mechanism Failure"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T16:40:38.385640Z", "id": "CVE-2026-23553", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T16:41:14.803Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/01/27/3"}, {"url": "http://xenbits.xen.org/xsa/advisory-479.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-28T16:12:31.841Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-23553", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T16:40:38.385640Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-665", "description": "CWE-665 Improper Initialization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T16:39:51.548Z"}}], "cna": {"title": "x86: incomplete IBPB for vCPU isolation", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by David Kaplan of AMD."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Guest processes may leverage information leaks to obtain information\nintended to be private to other entities in a guest."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-479"}], "defaultStatus": "unknown"}], "datePublic": "2026-01-27T12:00:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-479.html"}], "workarounds": [{"lang": "en", "value": "Using \"spec-ctrl=ibpb-entry=hvm,ibpb-entry=pv\" on the Xen command line\nwill activate the SRSO mitigation on non-SRSO-vulnerable hardware, but\nit is a large overhead."}], "descriptions": [{"lang": "en", "value": "In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks. Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A. Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB."}], "configurations": [{"lang": "en", "value": "Xen versions which had the XSA-254 fixes backported are vulnerable.\nUpstream, that is 4.6 and newer.\n\nOnly x86 systems are vulnerable. Arm systems are not vulerable.\n\nSystems vulnerable to SRSO (see XSA-434) with default settings use\nIBPB-on-entry to protect against SRSO. This is a rather more aggressive\nform of flushing than only on context switch, and is believed to be\nsufficient to avoid the vulnerability."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-01-28T15:33:44.782Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23553", "state": "PUBLISHED", "dateUpdated": "2026-01-28T16:41:14.803Z", "dateReserved": "2026-01-14T13:07:36.961Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2026-01-28T15:33:44.782Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-479"}]}], "source": "security@xen.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "matchCriteriaId": "4B8D71AF-016B-49EF-AE2B-95DEDE3BE3C3", "versionStartIncluding": "4.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks. Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A. Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB."}, {"lang": "es", "value": "En la l\u00f3gica de conmutaci\u00f3n de contexto, Xen intenta omitir un IBPB en el caso de que una vCPU regrese a una CPU en la que fue la vCPU anterior en ejecutarse. Si bien es seguro para el aislamiento de Xen entre vCPUs, esto impide que el kernel invitado a\u00edsle correctamente entre tareas. Considere:\n\n1) La vCPU se ejecuta en la CPU A, ejecutando la tarea 1.\n2) La vCPU se mueve a la CPU B, el proceso inactivo se programa en A. Xen omite el IBPB.\n3) En la CPU B, el kernel invitado cambia de la tarea 1 a la 2, emitiendo un IBPB.\n4) La vCPU regresa a la CPU A. Xen omite el IBPB de nuevo.\n\nAhora, la tarea 2 se est\u00e1 ejecutando en la CPU A con el entrenamiento de la tarea 1 todav\u00eda en el BTB."}], "id": "CVE-2026-23553", "lastModified": "2026-06-17T10:21:46.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23553", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T16:40:38.385640Z", "version": "2.0.3"}}]}, "published": "2026-01-28T16:16:16.853", "references": [{"source": "security@xen.org", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-479.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Mitigation", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/01/27/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "http://xenbits.xen.org/xsa/advisory-479.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-665"}, {"lang": "en", "value": "CWE-693"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:41:28.175457+00:00", "value": {"mitigation_remediation": ["Launch Xen with the spec-ctrl=ibpb-entry=hvm,ibpb-entry=pv option to activate the IBPB mitigation, accepting the performance overhead it introduces.", "If possible, bind individual virtual CPUs to dedicated virtual machines or disable vCPU migration to reduce BTB carry\u2011over between tasks.", "Apply any Xen update that includes a patch for the IBPB skipping bug when it becomes available.", "As a temporary measure, restrict untrusted guests from executing multiple concurrent tasks or isolate them in separate VMs to mitigate cross\u2011task leakage."], "summary": {"action": "Enable Spec-ctrl", "impact": "Speculative Execution Leakage"}, "threat_synthesis": {"affected_systems": "All Xen hypervisors operating on Intel x86 architectures are affected, as the flaw resides in Xen's default IBPB handling. The advisory indicates that the workaround of specifying spec-ctrl=ibpb-entry=hvm,ibpb-entry=pv on the Xen command line activates the SRSO mitigation on non\u2011SRSO\u2011vulnerable hardware, although this introduces significant performance overhead.", "description_and_impact": "The vulnerability stems from Xen's context switch logic skipping an IBPB when a virtual CPU returns to a physical processor it previously occupied. This omission means the guest kernel cannot fully purge the Branch Target Buffer state between tasks on the same virtual CPU, creating a speculative execution leakage channel. Based on the description, it is inferred that a malicious process running in one user task could exploit leftover BTB state to read data generated by another task that previously ran on the same virtual CPU.", "risk_and_exploitability": "The CVSS score of 2.9 denotes moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. The attack requires a guest with sufficient privileges to run multiple tasks on the same virtual CPU and to perform speculative execution reading, but no additional host privileges are needed. Consequently, the threat to confidentiality is measurable yet limited, with exploitation unlikely unless an attacker can orchestrate tasks within a compromised guest."}}}}, "created": "2026-01-29T09:09:13.239885+00:00", "updated": "2026-04-18T14:45:03.148106+00:00", "vendors": ["xen", "xen$PRODUCT$xen"]}