Vulnerability in Xen

[ Description ]Official description

With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOM_IO and DOM_COW are system domains which can have memory pages assigned to them.)

[ Fixes ]Fixes and patches

• Security bulletin: Citrix CTX697187Vendor patch or bulletin · CERT-FR · support.citrix.com/support-home/kbsearch/article, cited by CERT-FR CERTFR-2026-AVI-1310
• Security bulletin: Citrix CTX697181Vendor patch or bulletin · CERT-FR · support.citrix.com/support-home/kbsearch/article, cited by CERT-FR CERTFR-2026-AVI-1310
• Security bulletin: Citrix CTX697170Vendor patch or bulletin · CERT-FR · support.citrix.com/support-home/kbsearch/article, cited by CERT-FR CERTFR-2026-AVI-1310

[ Advisories ]Government CERT advisories

• CERT-FR14 Oct 2026CERTFR-2026-AVI-1302

  Multiple vulnerabilities in Xen Translated from French

  Multiple vulnerabilities have been discovered in Xen. Some of them allow an attacker to cause arbitrary code execution, privilege escalation and a breach of data confidentiality.

  CVE-2026-79611CVE-2023-34321CVE-2026-102700+10 more CVEs
• CERT-FR14 Oct 2026CERTFR-2026-AVI-1310

  Multiple vulnerabilities in Citrix products Translated from French

  Multiple vulnerabilities have been discovered in Citrix products. Some of them allow an attacker to cause arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-102700CVE-2026-53563CVE-2026-84419+5 more CVEs
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3930

  Xen: Multiple vulnerabilities Translated from German

  CVE-2026-102701CVE-2026-79610CVE-2026-102700+6 more CVEs

[ References ]References

• xenbits.xenproject.org/xsa/advisory-520.html
• xenbits.xen.org/xsa/advisory-520.html