CVE-2026-79602: x86: improper handling of HVM emulation return codes
A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.20.4+39-gf1e1321c87-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-1
Event History
Frequently Asked Questions
Which guest configurations are exposed to this issue?
A guest is exposed when it has an assigned PCI device with at least one BAR in I/O port space. The provided information does not establish that guests without such a device assignment are affected.
What does an attacker need to do to trigger the failure?
An attacker needs control of a guest that has the affected PCI device assignment and can cause the relevant HVM emulation path to handle the I/O-port BAR. Triggering it can cause Xen to hit a BUG().
What is the observable impact if exploitation succeeds?
The stated impact is a Xen BUG() condition. No further details about host availability, guest escape, data exposure, or persistence are provided.