CVE-2026-23554: fallo de gravedad alta en Xen
Use after free of paging structures in EPT
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.8epss 0.1%
The Intel EPT paging code uses an optimization to defer flushing of any cached
EPT state until the p2m lock is dropped, so that multiple modifications done
under the same locked region only issue a single flush.
Freeing of paging structures however is not deferred until the flushing is
done, and can result in freed pages transiently being present in cached state.
Such stale entries can point to memory ranges not owned by the guest, thus
allowing access to unintended memory regions.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Xen · XenCVEs relacionadas — Xen
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-31142HIGHx86: Incorrect logic for BTC/SRSO mitigationsEPSS 17.4%CVE-2024-2201MEDIUMCVE-2024-2201EPSS 8.8%CVE-2023-46842MEDIUMx86 HVM hypercalls may trigger Xen bug checkEPSS 8.5%CVE-2024-2193MEDIUMSpeculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.EPSS 1.3%CVE-2025-1713HIGHdeadlock potential with VT-d and legacy PCI device pass-throughEPSS 0.9%CVE-2023-46839MEDIUMpci: phantom functions assigned to incorrect contextsEPSS 0.8%