CVE-2026-79610

high

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations.

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.

CVSS

8.8

8.8 (CVSS v3.1)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

Timeline (UTC)

Published: 2026-10-13 16:17

Modified: 2026-10-20 18:17

NVD status: Awaiting Analysis

Last synced 1 day ago

Verified against the source API 2026-10-27 06:59 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-362

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://xenbits.xenproject.org/xsa/advisory-517.html security@xen.org
http://www.openwall.com/lists/oss-security/2026/10/13/6 af854a3a-2127-422b-91ae-364da2661108
http://xenbits.xen.org/xsa/advisory-517.html af854a3a-2127-422b-91ae-364da2661108

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:59 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores