https://seclists.org/oss-sec/2026/q4/147: Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush
Published Oct 13, 2026
·Updated
Affected Software
1 affected component
Xen Project Xen>=4.5
Frequently Asked Questions
1
What access does an attacker need to trigger these issues?
An attacker must control an unprivileged guest. The cache-flush operation can be issued against memory mapped from another domain through the grant table interface.
2
How do the effects differ between the two CVEs?
CVE-2026-102699 can cause an underflow that leads to an excessively long loop and likely eventual hypervisor crash, at least on 64-bit Arm. CVE-2026-102702 permits invalidate-without-clean on a read-only grant mapping, potentially corrupting memory granted by another domain.