CVE-2026-23558

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23558", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-01-14T13:07:36.961Z", "datePublished": "2026-05-19T12:49:54.652Z", "dateUpdated": "2026-05-20T03:55:35.327Z"}, "containers": {"cna": {"title": "grant table v2 race in status page mapping", "datePublic": "2026-04-28T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "The adjustments made for XSA-379 as well as those subsequently becoming\nXSA-387 still left a race window, when a HVM or PVH guest does a grant\ntable version change from v2 to v1 in parallel with mapping the status\npage(s) via XENMEM_add_to_physmap. Some of the status pages may then be\nfreed while mappings of them would still be inserted into the guest's\nsecondary (P2M) page tables."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Privilege escalation, information leaks, and Denial of Service (DoS) up\nto affecting the entire host cannot be excluded."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-486"}]}], "configurations": [{"lang": "en", "value": "All Xen versions from 4.0 onwards are affected. Xen versions 3.4 and\nolder are not affected.\n\nOnly x86 HVM and PVH guests permitted to use grant table version 2\ninterfaces can leverage this vulnerability. x86 PV guests cannot\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported."}], "workarounds": [{"lang": "en", "value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for HVM and PVH\nguests will also avoid the vulnerability."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Claude Opus 4.6 and diagnosed as a security\nissue by Rafal Wojtczuk."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-486.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-05-19T12:49:54.652Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/28/13"}, {"url": "http://xenbits.xen.org/xsa/advisory-486.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-19T13:06:51.044Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-23558"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T03:55:35.327Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/28/13"}, {"url": "http://xenbits.xen.org/xsa/advisory-486.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-19T13:06:51.044Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-23558", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T14:35:54.122600Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T14:34:47.852Z"}}], "cna": {"title": "grant table v2 race in status page mapping", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Claude Opus 4.6 and diagnosed as a security\nissue by Rafal Wojtczuk."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Privilege escalation, information leaks, and Denial of Service (DoS) up\nto affecting the entire host cannot be excluded."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-486"}], "defaultStatus": "unknown"}], "datePublic": "2026-04-28T12:00:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-486.html"}], "workarounds": [{"lang": "en", "value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for HVM and PVH\nguests will also avoid the vulnerability."}], "descriptions": [{"lang": "en", "value": "The adjustments made for XSA-379 as well as those subsequently becoming\nXSA-387 still left a race window, when a HVM or PVH guest does a grant\ntable version change from v2 to v1 in parallel with mapping the status\npage(s) via XENMEM_add_to_physmap. Some of the status pages may then be\nfreed while mappings of them would still be inserted into the guest's\nsecondary (P2M) page tables."}], "configurations": [{"lang": "en", "value": "All Xen versions from 4.0 onwards are affected. Xen versions 3.4 and\nolder are not affected.\n\nOnly x86 HVM and PVH guests permitted to use grant table version 2\ninterfaces can leverage this vulnerability. x86 PV guests cannot\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-05-19T12:49:54.652Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23558", "state": "PUBLISHED", "dateUpdated": "2026-05-19T14:36:29.452Z", "dateReserved": "2026-01-14T13:07:36.961Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2026-05-19T12:49:54.652Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-486"}]}], "source": "security@xen.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E095C1C-0DC6-4380-9333-477B13273E9E", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The adjustments made for XSA-379 as well as those subsequently becoming\nXSA-387 still left a race window, when a HVM or PVH guest does a grant\ntable version change from v2 to v1 in parallel with mapping the status\npage(s) via XENMEM_add_to_physmap. Some of the status pages may then be\nfreed while mappings of them would still be inserted into the guest's\nsecondary (P2M) page tables."}, {"lang": "es", "value": "Los ajustes realizados para XSA-379, as\u00ed como aquellos que posteriormente se convirtieron en XSA-387, a\u00fan dejaban una ventana de carrera, cuando un invitado HVM o PVH realiza un cambio de versi\u00f3n de tabla de concesi\u00f3n de v2 a v1 en paralelo con el mapeo de la(s) p\u00e1gina(s) de estado a trav\u00e9s de XENMEM_add_to_physmap. Algunas de las p\u00e1ginas de estado pueden entonces ser liberadas mientras los mapeos de estas a\u00fan estar\u00edan insertados en las tablas de p\u00e1ginas secundarias (P2M) del invitado."}], "id": "CVE-2026-23558", "lastModified": "2026-10-14T20:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 6.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23558", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-19T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-19T14:16:38.960", "references": [{"source": "security@xen.org", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-486.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Mitigation", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/28/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "http://xenbits.xen.org/xsa/advisory-486.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "consult Xen advisory XSA-486"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Xen", "source": "cna", "vendor": "Xen"}, "product": "xen", "vendor": "xen"}], "created": "2026-05-19T14:45:07.490991+00:00", "updated": "2026-05-19T17:30:10.602037+00:00", "vendors": ["xen", "xen$PRODUCT$xen"]}