CVE-2022-23960Medium· 5.6▾ SunlitCertain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted br…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.
xencortex-r7_firmwarecortex-r8_firmwarecortex-a57_firmwarecortex-a65_firmwarecortex-a65ae_firmwarecortex-a710_firmwarecortex-a72_firmwarecortex-a73_firmwarecortex-a75_firmwarecortex-a76_firmwarecortex-a76ae_firmwarecortex-a77_firmwarecortex-a78_firmwarecortex-a78ae_firmwarecortex-x1_firmwarecortex-x2_firmwareneoverse-e1_firmwareneoverse-v1_firmwareneoverse_n1_firmwareneoverse_n2_firmwaredebian_linux = 9.0debian_linux = 10.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-62437Medium· 6.5When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early…
CVE-2026-79602High· 8.8A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
CVE-2023-34319High· 7.8The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece
CVE-2026-79609High· 8.8XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254)
CVE-2026-79610High· 8.8XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations
CVE-2026-79611Medium· 5.5For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state…