Xen flaws let a guest VM read and write other VMs' memory

The Xen Project published advisory XSA-523 on November 3, disclosing two hypervisor flaws that let a malicious guest virtual machine read and write the memory of other VMs on the same host, including dom0. The flaws are tracked as CVE-2026-102703 and CVE-2026-102704. Patches are out, and there is no known mitigation, the project said.

All Xen versions from 4.6 onward are vulnerable. Versions 4.5 and earlier are not. Dom0 is the VM that by default has full permissions and manages the others.

How the flaws work

The flaws sit in grant copy, the operation Xen uses to copy data between VMs. Each VM tells Xen which of its memory pages other VMs may use, and Xen checks those permissions. To save time on a batch of copies within the same memory page, Xen reuses checks it has already made. In some cases it did not check again when it should have. That mistake lets a malicious guest read and write memory it does not own.

XCP-ng, an open-source virtualization platform built around Xen, said in its update notes that "a single compromised guest can break out of its isolation and take over the whole host." Vates, which backs XCP-ng, rates the impact as Critical.

Claude found the bugs

The Xen Project credited AI company Anthropic with finding the flaws using its Claude model. Stephan Lipp of Ada Logics validated the finding. The CodeAnt AI Security Research Team later independently reported the same issue.

Fixes and restarts by platform

The advisory has patches for xen-unstable to Xen 4.19.x, and for Xen 4.18.x to 4.17.x. It carries no patch for Xen 4.6 to 4.16. Xen 4.16's security support ended on December 2, 2024.

XCP-ng 8.3 has a fix: xen-4.17.7-4.2.xcpng8.3, released November 3. Hosts must be rebooted.

Qubes OS, a security-focused desktop operating system that keeps software in separate Xen-based compartments called qubes, said every supported release and configuration is affected. Its fix is for Qubes 4.3, the only release it still supports. The Xen packages are 4.19.6-3 in dom0. Dom0 must be restarted, and Anti Evil Maid users must reseal their secret passphrase because the new Xen binaries change PCR18 and PCR19.

Because every Xen version from 4.6 on is vulnerable, other products built on those versions are affected until their makers add the XSA-523 patches. As of November 4, Debian's security tracker listed the xen package in its bookworm, trixie, and forky releases as vulnerable, and in sid as fixed.

What happens next

Qubes told users on November 3 to keep installing updates as normal. The fixed packages were then in its security-testing repository, due to move to the stable one over the next two weeks after community testing. The Xen advisory does not mention any attacks that exploit the flaws or specify what access within the VM an attacker needs. XSA-523 is separate from XSA-500, an earlier grant copy flaw that Xen disclosed on July 28, and it has its own patches.