CVE-2026-23558

The record

The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of the status pages may then be freed while mappings of them would still be inserted into the guest's secondary (P2M) page tables.

Affected packages

Related vulnerabilities

• CVE-2026-23557 Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a… Also affects xen
• CVE-2025-54518 Improper isolation of shared resources within the CPU operation cache on Zen 2-based… Also affects xen
• CVE-2026-23554 The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state… Also affects xen
• CVE-2026-23555 Any guest issuing a Xenstore command accessing a node using the (illegal) node path… Also affects xen
• CVE-2026-23553 In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning… Also affects xen
• CVE-2025-58150 Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter… Also affects xen
• CVE-2024-45818 The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the… Also affects xen
• CVE-2024-45819 PVH guests have their ACPI tables constructed by the toolstack. Also affects xen