Xen hypervisor flaws in XSA-523 let a malicious guest VM read and write other VMs' memory

TLDR

• Xen says two grant copy flaws let a malicious guest read and write other domains' memory, including dom0.²
• Xen 4.6 onwards is affected; the advisory lists no mitigation and no patch for 4.6 to 4.16.²
• Fixed packages are out for XCP-ng 8.3 and Qubes 4.3, and both need a reboot to take effect.³⁴

Two flaws in the Xen hypervisor let a malicious guest virtual machine read and write the memory of other VMs on the same host, including dom0, the VM that by default has full permissions and manages the others, The Hacker News reports.¹ The Xen Project published the advisory, XSA-523, on 3 November 2026, covering CVE-2026-102703 and CVE-2026-102704.² It says a malicious guest can read and write arbitrary memory belonging to other domains, including dom0.² The advisory credits Anthropic, which found the issue using its Claude model, with Stephan Lipp of Ada Logics validating it; it adds that the CodeAnt AI Security Research Team independently reported it.²

Both flaws sit in grant copy, the operation Xen uses to copy data between VMs.¹ The advisory says a common pattern is a batch of grant copy operations on adjacent address ranges in the same page, and that Xen caches details internally to reuse already validated data.² The conditions for re-validating that data were not correct in some cases.² In CVE-2026-102703, frame numbers and grant references could be wrongly mixed up.² In CVE-2026-102704, copying by frame number is allowed only on the caller's own memory, but the check enforcing that was misplaced.² All Xen versions from 4.6 onwards are vulnerable and 4.5 and earlier are not, and the advisory says there is no known mitigation.² Its patches cover xen-unstable to Xen 4.19.x and Xen 4.18.x to 4.17.x, with none listed for 4.6 to 4.16.² The Hacker News notes that security support for Xen 4.16 ended on 2 December 2024.¹

Vendors began shipping fixes on 3 November. XCP-ng 8.3 received xen-4.17.7-4.2.xcpng8.3 and its update notes say host reboots are necessary and that a single compromised guest can break out of its isolation and take over the whole host.⁴⁵ Vates rates the impact on its products as Critical.⁵ Qubes OS says every supported release and configuration is affected; its fix for Qubes 4.3 is Xen 4.19.6-3 in dom0, which was in the security-testing repository at publication, needs a dom0 restart, and requires Anti Evil Maid users to reseal their secret passphrase because PCR18 and PCR19 change.³ Citrix's XenServer bulletin, marked Critical at bulletin level and covering several issues, lists CVE-2026-102703 as an issue that may allow a privileged user in a guest VM to compromise the host, and says updates are available on the Early Access and Normal channels of XenServer 8.4 and 9.⁶ On Debian, The Hacker News and Rescana reported on 4 November that the xen package was still vulnerable in bookworm, trixie and forky.¹⁷ Debian's security tracker page now lists the bookworm and trixie security packages as fixed, via DLA-4881-1 and DSA-6610-1, with the standard bookworm and trixie packages and forky still marked vulnerable.⁸

The sources leave several points open. The Xen advisory does not mention attacks exploiting the flaws, and The Hacker News says it does not specify what access inside the guest an attacker needs.¹ Rescana, a security analysis firm, reports that the Xen Project has published no CVSS score, that the National Vulnerability Database lists both CVEs as received without metrics, and that the flaws are not in CISA's Known Exploited Vulnerabilities catalogue.⁷ It also reports that SUSE rates the issue important and has shipped a fix for SUSE Linux Enterprise 15 SP7, that Red Hat says no supported Red Hat product is affected, and that Xen has pre-announced XSA-529 and XSA-530 for public release on 10 November 2026; none of these points is confirmed by the other sources.⁷ The Hacker News says XSA-523 is separate from XSA-500, an earlier grant copy flaw disclosed on 28 July.¹

Why it matters: the separation between guests is the boundary Xen-based platforms exist to enforce, and XCP-ng says this flaw is a guest escape with no known mitigation other than the fix.⁴