CVE-2026-102703Medium· 4.4▾ Sunlit[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases:
Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703.
Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704.
XenRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
There is no known mitigation.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102704Medium· 4.4arbitrary read/write via grant copy
CVE-2023-34319High· 7.8The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece
CVE-2026-79609High· 8.8XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254)
CVE-2026-79610High· 8.8XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations
CVE-2026-79611Medium· 5.5For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state…
CVE-2026-79607Medium· 5.5During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing