CVE-2026-23554
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Mar 23, 2026
CISA due date
—
The record
The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | xen | 0 | 4.18.5_12-150600.3.40.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | xen | 0 | 4.18.5_12-150600.3.40.1 |
| openSUSE:Leap 15.6 | xen | 0 | 4.18.5_12-150600.3.40.1 |
| openSUSE:Tumbleweed | xen | 0 | 4.21.1_02-1.1 |
Related vulnerabilities
- CVE-2026-23555 Any guest issuing a Xenstore command accessing a node using the (illegal) node path… Also affects xen
- CVE-2026-23553 In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning… Also affects xen
- CVE-2025-58150 Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter… Also affects xen
- CVE-2024-45818 The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the… Also affects xen
- CVE-2024-45819 PVH guests have their ACPI tables constructed by the toolstack. Also affects xen
- CVE-2024-31145 Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via… Also affects xen
- CVE-2024-31146 When multiple devices share resources and one of them is to be passed through to a guest… Also affects xen
- CVE-2024-45817 In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions… Also affects xen