{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23558", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-01-14T13:07:36.961Z", "datePublished": "2026-05-19T12:49:54.652Z", "dateUpdated": "2026-05-19T13:06:51.044Z"}, "containers": {"cna": {"title": "grant table v2 race in status page mapping", "datePublic": "2026-04-28T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "The adjustments made for XSA-379 as well as those subsequently becoming\nXSA-387 still left a race window, when a HVM or PVH guest does a grant\ntable version change from v2 to v1 in parallel with mapping the status\npage(s) via XENMEM_add_to_physmap. Some of the status pages may then be\nfreed while mappings of them would still be inserted into the guest's\nsecondary (P2M) page tables."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Privilege escalation, information leaks, and Denial of Service (DoS) up\nto affecting the entire host cannot be excluded."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-486"}]}], "configurations": [{"lang": "en", "value": "All Xen versions from 4.0 onwards are affected. Xen versions 3.4 and\nolder are not affected.\n\nOnly x86 HVM and PVH guests permitted to use grant table version 2\ninterfaces can leverage this vulnerability. x86 PV guests cannot\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported."}], "workarounds": [{"lang": "en", "value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for HVM and PVH\nguests will also avoid the vulnerability."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Claude Opus 4.6 and diagnosed as a security\nissue by Rafal Wojtczuk."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-486.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-05-19T12:49:54.652Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/28/13"}, {"url": "http://xenbits.xen.org/xsa/advisory-486.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-19T13:06:51.044Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The adjustments made for XSA-379 as well as those subsequently becoming\nXSA-387 still left a race window, when a HVM or PVH guest does a grant\ntable version change from v2 to v1 in parallel with mapping the status\npage(s) via XENMEM_add_to_physmap. Some of the status pages may then be\nfreed while mappings of them would still be inserted into the guest's\nsecondary (P2M) page tables."}], "id": "CVE-2026-23558", "lastModified": "2026-05-19T14:16:38.960", "metrics": {}, "published": "2026-05-19T14:16:38.960", "references": [{"source": "security@xen.org", "url": "https://xenbits.xenproject.org/xsa/advisory-486.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/04/28/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://xenbits.xen.org/xsa/advisory-486.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Received"}

{}

{}