Xen flaws let malicious virtual machines access host memory

Two vulnerabilities in the Xen hypervisor could allow a malicious guest VM to read and write memory belonging to other VMs on the same host, including dom0. The Xen Project disclosed advisory XSA-523 on 3 November 2026, noting that all Xen versions 4.6 and newer are vulnerable, while 4.5 and earlier are not. The flaws are tracked as CVE-2026-102703 and CVE-2026-102704 and stem from an error in grant copy, Xen’s mechanism for copying data between VMs.

In batches that copy within the same memory page, Xen sometimes reused prior permission checks and failed to re-verify permissions, enabling a malicious guest to access memory it does not own.

Evidence and impact cited by affected projects include XCP-ng stating that “a single compromised guest can break out of its isolation and take over the whole host.” Qubes OS confirms that every supported Xen-based release and configuration is affected and notes a fix only in Qubes 4.3. Debian’s security tracker listed the Xen xen package as vulnerable in bookworm, trixie and forky, with sid marked as fixed.

The Xen advisory provides patches for Xen 4.17.x–4.19.x and for Xen unstable to 4.19.x, but no patches for Xen 4.6–4.16. For platforms like XCP-ng 8.3 and Qubes OS 4.3, restarting hosts or dom0 is required to apply fixes, and in Qubes, resealing anti-evil-maid secrets may be necessary due to updated Xen binaries. The advisory attributes the findings to Anthropic’s Claude model, with validation by Stephan Lipp (Ada Logics) and later independent confirmation by CodeAnt AI Security Research Team.