https://seclists.org/oss-sec/2026/q4/149: Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif()
Published Oct 13, 2026
·Updated
Affected Software
1 affected component
XEN tapdisk
Frequently Asked Questions
1
Which deployments are exposed?
All versions of tapdisk are vulnerable. The affected component is the userspace xen-blkback implementation used by the XAPI toolstack.
2
What does an attacker need to exploit this issue?
A buggy or malicious guest must connect to tapdisk and request a multi-page ring size exceeding the assumed limit of 8. The missing boundary check can then cause a stack overflow.
3
What is the likely impact of successful exploitation?
A malicious guest can cause a stack overflow in tapdisk, potentially resulting in code execution. Tapdisk normally runs as root, making successful code execution particularly severe.
4
What can be done if the patch cannot be applied immediately?
The advisory states that there are no mitigations. Applying the attached xsa521.patch is the stated resolution.