CVE-2026-102702: Arm: multiple issues with GNTTABOP_cache_flush
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOPcacheflush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor.
This is CVE-2026-102699.
2) GNTTABOPcacheflush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory.
This is CVE-2026-102702.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Disallow the use of invalidate-without-clean against read-only grant mappings.
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
The issue affects Arm Xen environments where a guest uses the grant table interface to map memory from another domain. The affected operation is GNTTABOP_cache_flush.
What must an attacker be able to do to exploit it?
An attacker needs to issue GNTTABOP_cache_flush against memory mapped from another domain through a grant mapping, using invalidate-without-clean on a read-only mapping. Xen did not restrict that combination, allowing the granted memory to be corrupted.