CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak
With its original introduction, GNTTABcacheflush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOMIO and DOMCOW are system domains which can have memory pages assigned to them.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.20.4+39-gf1e1321c87-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-1
Event History
Frequently Asked Questions
Under what condition does the page reference leak occur?
It occurs on the cache-flush error path when the specified page is owned by a special system domain. The affected special domains identified are DOM_IO and DOM_COW, which can have memory pages assigned to them.
Does the earlier NULL-pointer-check fix fully address this issue?
No. The NULL pointer check added following XSA-232 (CVE-2017-14318) did not adjust the subsequent error path, which is where the page reference is not dropped.