CVE-2026-79603: Unconditionally do TLB flushing ahead of page scrubbing
x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects x86 PV guests. The described exposure is tied to guest memory pages that are freed while a stale TLB entry still points to them.
What condition enables a guest to modify a scrubbed page?
A stale TLB entry must remain after the guest frees a page, and the page must be scrubbed before Xen performs any needed TLB flush. During that window, the PV guest can still use the stale mapping to modify the page.
Is page reuse required for Xen to issue the relevant TLB flush?
Yes. Xen issues a TLB flush, if needed, when the page is re-used. The vulnerability exists because scrubbing can occur before that reuse-triggered flush.