https://seclists.org/oss-sec/2026/q4/149: Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif()
Published Oct 13, 2026
·Updated
Affected Software
1 affected component
XEN tapdisk
All versions of tapdisk are vulnerable. The affected component is the userspace xen-blkback implementation used by the XAPI toolstack.
A buggy or malicious guest must connect to tapdisk and request a multi-page ring size exceeding the assumed limit of 8. The missing boundary check can then cause a stack overflow.
A malicious guest can cause a stack overflow in tapdisk, potentially resulting in code execution. Tapdisk normally runs as root, making successful code execution particularly severe.
The advisory states that there are no mitigations. Applying the attached xsa521.patch is the stated resolution.