CVE-2026-79603: Unconditionally do TLB flushing ahead of page scrubbing

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-08 · updated 2026-09-08
Weakness: CWE-664

Description

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.

References

https://xenbits.xenproject.org/xsa/advisory-511.html
http://www.openwall.com/lists/oss-security/2026/09/08/8
http://xenbits.xen.org/xsa/advisory-511.html

Get alerted when CVE-2026-79603 or the next vulnerability affects your stack