CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak
With its original introduction, GNTTABcacheflush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOMIO and DOMCOW are system domains which can have memory pages assigned to them.)
Affected Software
Event History
Frequently Asked Questions
Under what condition does the page reference leak occur?
It occurs on the cache-flush error path when the specified page is owned by a special system domain. The affected special domains identified are DOM_IO and DOM_COW, which can have memory pages assigned to them.
Does the earlier NULL-pointer-check fix fully address this issue?
No. The NULL pointer check added following XSA-232 (CVE-2017-14318) did not adjust the subsequent error path, which is where the page reference is not dropped.