{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102702", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-09-29T16:11:40.973Z", "datePublished": "2026-10-13T15:45:13.125Z", "dateUpdated": "2026-10-13T15:45:13.125Z"}, "containers": {"cna": {"title": "Arm: multiple issues with GNTTABOP_cache_flush", "datePublic": "2026-10-13T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n calculations involved in guests flushing caches through\n GNTTABOP_cache_flush. Unfortunately the fix there introduced a\n calculation which may underflow, resulting in a loop which would - at\n least on 64-bit Arm - take excessively long, and which would likely\n eventually crash the hypervisor.\n\n This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n domain using the grant table interface. However there was no\n restriction to disallow the use of invalidate-without-clean against\n read-only grant mappings, which may corrupt the granted memory.\n\n This is CVE-2026-102702."}], "impacts": [{"descriptions": [{"lang": "en", "value": "A malicious unprivileged guest may crash the hypervisor, causing a\nDenial of Service (DoS) affecting the entire host, or corrupt memory\nbelonging to another domain. Privilege escalation and information leaks\ncannot be ruled out."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-519"}]}], "configurations": [{"lang": "en", "value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable.\n\nOnly Arm systems are vulnerable. x86 systems are not vulnerable."}], "workarounds": [{"lang": "en", "value": "There is no known mitigation."}], "credits": [{"lang": "en", "type": "finder", "value": "CVE-2026-102699 was discovered by Leonid Komarianskyi of EPAM. It was\nlater independently reported by Ayan Kumar Halder of AMD.\n\nCVE-2026-102702 was found by the security team while looking at the\nsurrounding code."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-519.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-10-13T15:45:13.125Z"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-519"}]}], "source": "security@xen.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n calculations involved in guests flushing caches through\n GNTTABOP_cache_flush. Unfortunately the fix there introduced a\n calculation which may underflow, resulting in a loop which would - at\n least on 64-bit Arm - take excessively long, and which would likely\n eventually crash the hypervisor.\n\n This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n domain using the grant table interface. However there was no\n restriction to disallow the use of invalidate-without-clean against\n read-only grant mappings, which may corrupt the granted memory.\n\n This is CVE-2026-102702."}], "id": "CVE-2026-102702", "lastModified": "2026-10-13T16:17:09.723", "metrics": {}, "published": "2026-10-13T16:17:09.723", "references": [{"source": "security@xen.org", "url": "https://xenbits.xenproject.org/xsa/advisory-519.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Received"}

{}

{}