CVE-2026-23554

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23554", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-01-14T13:07:36.961Z", "datePublished": "2026-03-23T06:56:52.344Z", "dateUpdated": "2026-03-23T14:19:27.752Z"}, "containers": {"cna": {"title": "Use after free of paging structures in EPT", "datePublic": "2026-03-17T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "The Intel EPT paging code uses an optimization to defer flushing of any cached\nEPT state until the p2m lock is dropped, so that multiple modifications done\nunder the same locked region only issue a single flush.\n\nFreeing of paging structures however is not deferred until the flushing is\ndone, and can result in freed pages transiently being present in cached state.\nSuch stale entries can point to memory ranges not owned by the guest, thus\nallowing access to unintended memory regions."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Privilege escalation, Denial of Service (DoS) affecting the entire host,\nand information leaks."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-480"}]}], "configurations": [{"lang": "en", "value": "Xen 4.17 and onwards are vulnerable. Xen 4.16 and older are not vulnerable.\n\nOnly x86 Intel systems with EPT support are vulnerable.\n\nOnly x86 HVM/PVH guests using HAP can leverage the vulnerability on affected\nsystems."}], "workarounds": [{"lang": "en", "value": "There are no mitigations."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Roger Pau Monn\u00e9 of XenServer."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-480.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-03-23T06:56:52.344Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/17/6"}, {"url": "http://xenbits.xen.org/xsa/advisory-480.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-23T07:32:25.539Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-367", "lang": "en", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T14:18:54.774466Z", "id": "CVE-2026-23554", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T14:19:27.752Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/17/6"}, {"url": "http://xenbits.xen.org/xsa/advisory-480.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-23T07:32:25.539Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-23554", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-23T14:18:54.774466Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T14:17:26.808Z"}}], "cna": {"title": "Use after free of paging structures in EPT", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Roger Pau Monn\u00e9 of XenServer."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Privilege escalation, Denial of Service (DoS) affecting the entire host,\nand information leaks."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-480"}], "defaultStatus": "unknown"}], "datePublic": "2026-03-17T12:00:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-480.html"}], "workarounds": [{"lang": "en", "value": "There are no mitigations."}], "descriptions": [{"lang": "en", "value": "The Intel EPT paging code uses an optimization to defer flushing of any cached\nEPT state until the p2m lock is dropped, so that multiple modifications done\nunder the same locked region only issue a single flush.\n\nFreeing of paging structures however is not deferred until the flushing is\ndone, and can result in freed pages transiently being present in cached state.\nSuch stale entries can point to memory ranges not owned by the guest, thus\nallowing access to unintended memory regions."}], "configurations": [{"lang": "en", "value": "Xen 4.17 and onwards are vulnerable. Xen 4.16 and older are not vulnerable.\n\nOnly x86 Intel systems with EPT support are vulnerable.\n\nOnly x86 HVM/PVH guests using HAP can leverage the vulnerability on affected\nsystems."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-03-23T06:56:52.344Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23554", "state": "PUBLISHED", "dateUpdated": "2026-03-23T14:19:27.752Z", "dateReserved": "2026-01-14T13:07:36.961Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2026-03-23T06:56:52.344Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-480"}]}], "source": "security@xen.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "matchCriteriaId": "1B149544-81AE-4439-B77E-F4C973187511", "versionStartIncluding": "4.17", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Intel EPT paging code uses an optimization to defer flushing of any cached\nEPT state until the p2m lock is dropped, so that multiple modifications done\nunder the same locked region only issue a single flush.\n\nFreeing of paging structures however is not deferred until the flushing is\ndone, and can result in freed pages transiently being present in cached state.\nSuch stale entries can point to memory ranges not owned by the guest, thus\nallowing access to unintended memory regions."}, {"lang": "es", "value": "El c\u00f3digo de paginaci\u00f3n EPT de Intel utiliza una optimizaci\u00f3n para aplazar el vaciado de cualquier estado EPT en cach\u00e9 hasta que se libere el bloqueo p2m, de modo que m\u00faltiples modificaciones realizadas bajo la misma regi\u00f3n bloqueada solo emitan un \u00fanico vaciado.\n\nLa liberaci\u00f3n de estructuras de paginaci\u00f3n, sin embargo, no se aplaza hasta que se complete el vaciado, y puede resultar en que las p\u00e1ginas liberadas est\u00e9n transitoriamente presentes en estado de cach\u00e9. Dichas entradas obsoletas pueden apuntar a rangos de memoria no pose\u00eddos por el invitado, permitiendo as\u00ed el acceso a regiones de memoria no intencionadas."}], "id": "CVE-2026-23554", "lastModified": "2026-06-17T10:21:46.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 6.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23554", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T14:18:54.774466Z", "version": "2.0.3"}}]}, "published": "2026-03-23T07:16:07.200", "references": [{"source": "security@xen.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-480.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/17/6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://xenbits.xen.org/xsa/advisory-480.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "consult Xen advisory XSA-480"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Xen", "source": "cna", "vendor": "Xen"}, "product": "xen", "vendor": "xen"}], "analysis": {"en": {"generated_at": "2026-04-10T21:53:56.555413+00:00", "value": {"mitigation_remediation": ["Monitor Xen logs for abnormal memory errors or crashes that could indicate use\u2011after\u2011free activity. ", "Restrict guest workloads to trusted, hardened images and avoid allowing arbitrary code execution within guests. ", "Keep the Xen hypervisor updated to the latest stable releases from the vendor once a patch for this vulnerability is published. ", "Enforce strict isolation and network segmentation between guests and the hypervisor to limit potential lateral movement."], "summary": {"action": "Assess Impact", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The flaw targets Xen hypervisor installations running on x86 hardware, as indicated by the associated CPE string. No specific Xen version numbers are provided in the CNA data, so all Xen deployments on x86 should be treated as potentially vulnerable until a vendor patch is released.", "description_and_impact": "The vulnerability arises because the Intel EPT paging code defers flushing of cached EPT entries until the p2m lock is released, while freeing of paging structures occurs immediately. This mismatch can leave freed memory pages in a stale cached state, and the stale entries may reference memory ranges that are no longer owned by the victim guest. A malicious guest can trigger this behavior to read or potentially write to host memory outside of its designated area, effectively creating a use\u2011after\u2011free condition (CWE\u2011367).", "risk_and_exploitability": "The CVSS score of 7.8 indicates high severity, while the EPSS metric of <1\u202f% suggests the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation would most likely originate from code running inside a guest that forces the deferred flush while freeing paging structures. Successful exploitation could compromise host confidentiality, integrity, or availability if the attacker can read or overwrite shared memory."}}}}, "created": "2026-03-24T10:34:56.734953+00:00", "updated": "2026-04-13T14:28:22.948514+00:00", "vendors": ["xen", "xen$PRODUCT$xen"]}