CVE-2026-102699: Arm: multiple issues with GNTTABOP_cache_flush
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.20.4+39-gf1e1321c87-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-1
Event History
Frequently Asked Questions
Which systems are exposed to the hypervisor crash condition?
The issue affects Xen on Arm where a guest can use GNTTABOP_cache_flush. The advisory text specifically notes that the loop is excessively long at least on 64-bit Arm and would likely eventually crash the hypervisor.
What must an attacker be able to do to trigger the issue?
An attacker would need the ability to act from a guest and issue cache-flush operations through GNTTABOP_cache_flush. The problematic underflow occurs in calculations used for guest cache flushing.
What is the expected impact of successful exploitation?
The underflow can cause an excessively long loop and is likely to eventually crash the Xen hypervisor. This can disrupt all workloads running on the affected host.