CVE-2026-102699: Arm: multiple issues with GNTTABOP_cache_flush
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOPcacheflush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor.
This is CVE-2026-102699.
2) GNTTABOPcacheflush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory.
This is CVE-2026-102702.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For Arm guests using GNTTABOP_cache_flush, disallow the use of invalidate-without-clean against read-only grant mappings.
Event History
Frequently Asked Questions
Which systems are exposed to the hypervisor crash condition?
The issue affects Xen on Arm where a guest can use GNTTABOP_cache_flush. The advisory text specifically notes that the loop is excessively long at least on 64-bit Arm and would likely eventually crash the hypervisor.
What must an attacker be able to do to trigger the issue?
An attacker would need the ability to act from a guest and issue cache-flush operations through GNTTABOP_cache_flush. The problematic underflow occurs in calculations used for guest cache flushing.
What is the expected impact of successful exploitation?
The underflow can cause an excessively long loop and is likely to eventually crash the Xen hypervisor. This can disrupt all workloads running on the affected host.