CVE-2026-79609

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-79609", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-08-25T07:35:05.289Z", "datePublished": "2026-10-13T15:44:24.763Z", "dateUpdated": "2026-10-20T17:34:39.462Z"}, "containers": {"cna": {"title": "x86: XPTI may break on huge-memory systems", "datePublic": "2026-10-13T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown\n(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV\nguest page table entries from guest-chosen root page tables to the Xen-\nchosen one which is in actual use by hardware. To read the guest root\npage table, the directmap is used. PV guests, however, have a directmap\nwhich may not cover all memory; in particular this is the case if any\nmemory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address\nboundary."}], "impacts": [{"descriptions": [{"lang": "en", "value": "A 64-bit PV guest may be able to elevate its privilege to that of the\nhost. It is also possible for them to observe information pertaining to\nother guests, or to cause Denial of Service (DoS) affecting the entire\nhost."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-516"}]}], "configurations": [{"lang": "en", "value": "All versions of Xen with the XPTI work backported to are affected. In\nupstream these are Xen 4.7.5 and onwards, Xen 4.8.3 and onwards, Xen 4.9.2\nand onwards, Xen 4.10.1 and onwards, and all major releases from 4.11\nonwards.\n\nOnly 64-bit PV guests can leverage the vulnerability. HVM and PVH guests\ncannot leverage the vulnerability. 32-bit PV guests haven't been security\nsupported anymore.\n\nOnly x86 systems are affected. Arm systems are not affected.\n\nOnly systems with RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) boundary\nare affected. Systems with no RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5\nTiB) boundary are not affected."}], "workarounds": [{"lang": "en", "value": "Not running 64-bit PV guests will avoid the vulnerability.\n\nThe \"mem=\" hypervisor command line option may be used to limit the amount\nof memory Xen is going to use. That would be \"mem=5T\" for the\nCONFIG_BIGMEM=n case and \"mem=3584G\" for the CONFIG_BIGMEM=y one."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by George Dunlap."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-516.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-10-13T15:44:24.763Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-516.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-13T16:13:43.715Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T17:34:35.122730Z", "id": "CVE-2026-79609", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T17:34:39.462Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-516.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-13T16:13:43.715Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-79609", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-20T17:34:35.122730Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T17:34:09.234Z"}}], "cna": {"title": "x86: XPTI may break on huge-memory systems", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by George Dunlap."}], "impacts": [{"descriptions": [{"lang": "en", "value": "A 64-bit PV guest may be able to elevate its privilege to that of the\nhost. It is also possible for them to observe information pertaining to\nother guests, or to cause Denial of Service (DoS) affecting the entire\nhost."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-516"}], "defaultStatus": "unknown"}], "datePublic": "2026-10-13T12:00:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-516.html"}], "workarounds": [{"lang": "en", "value": "Not running 64-bit PV guests will avoid the vulnerability.\n\nThe \"mem=\" hypervisor command line option may be used to limit the amount\nof memory Xen is going to use. That would be \"mem=5T\" for the\nCONFIG_BIGMEM=n case and \"mem=3584G\" for the CONFIG_BIGMEM=y one."}], "descriptions": [{"lang": "en", "value": "XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown\n(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV\nguest page table entries from guest-chosen root page tables to the Xen-\nchosen one which is in actual use by hardware. To read the guest root\npage table, the directmap is used. PV guests, however, have a directmap\nwhich may not cover all memory; in particular this is the case if any\nmemory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address\nboundary."}], "configurations": [{"lang": "en", "value": "All versions of Xen with the XPTI work backported to are affected. In\nupstream these are Xen 4.7.5 and onwards, Xen 4.8.3 and onwards, Xen 4.9.2\nand onwards, Xen 4.10.1 and onwards, and all major releases from 4.11\nonwards.\n\nOnly 64-bit PV guests can leverage the vulnerability. HVM and PVH guests\ncannot leverage the vulnerability. 32-bit PV guests haven't been security\nsupported anymore.\n\nOnly x86 systems are affected. Arm systems are not affected.\n\nOnly systems with RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) boundary\nare affected. Systems with no RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5\nTiB) boundary are not affected."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-10-13T15:44:24.763Z"}}}, "cveMetadata": {"cveId": "CVE-2026-79609", "state": "PUBLISHED", "dateUpdated": "2026-10-20T17:34:39.462Z", "dateReserved": "2026-08-25T07:35:05.289Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2026-10-13T15:44:24.763Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-516"}]}], "source": "security@xen.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown\n(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV\nguest page table entries from guest-chosen root page tables to the Xen-\nchosen one which is in actual use by hardware. To read the guest root\npage table, the directmap is used. PV guests, however, have a directmap\nwhich may not cover all memory; in particular this is the case if any\nmemory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address\nboundary."}], "id": "CVE-2026-79609", "lastModified": "2026-10-20T18:17:22.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-79609", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T17:34:35.122730Z", "version": "2.0.3"}}]}, "published": "2026-10-13T16:17:23.147", "references": [{"source": "security@xen.org", "url": "https://xenbits.xenproject.org/xsa/advisory-516.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://xenbits.xen.org/xsa/advisory-516.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unknown", "versions": {"scheme": "generic", "value": "consult Xen advisory XSA-516"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Xen", "source": "cna", "vendor": "Xen"}, "product": "xen", "vendor": "xen"}], "created": "2026-10-13T18:45:15.562893+00:00", "updated": "2026-10-23T07:15:17.236710+00:00", "vendors": ["xen", "xen$PRODUCT$xen"]}