Title: Xen Hypervisor Grant Copy Flaws Give a Guest Arbitrary Read/Write Across the Host, Including Dom0
Summary: Two flaws in Xen’s grant-copy operation — the hypervisor mechanism for copying data between VMs — allow a malicious guest to read and write arbitrary memory belonging to other domains, including dom0, the privileged management VM. Xen discloses them as CVE-2026-102703 and CVE-2026-102704 under advisory XSA-523, released November 3: Xen caches grant-copy validation results for batches of operations on the same page, and in some cases failed to re-validate — once letting frame numbers and grant references be mixed up, and once with the check restricting copy-by-frame-number to the caller’s own memory misplaced. Every Xen version from 4.6 onward is affected, and the project lists no known mitigation. The bugs were found by Anthropic using its Claude model, validated by Stephan Lipp of Ada Logics, and independently reported by the CodeAnt AI Security Research Team, which separately demonstrated a working guest-to-dom0 escape on XenServer 9 — running code in the dom0 Linux kernel from a guest — calling the bug “Xenbleed” and rating the two CVEs 9.3 under CVSS 3.1. XSA-523 ships patches for Xen through 4.19.x and 4.18.x–4.17.x, but nothing for 4.6–4.16; downstream, XCP-ng released a fixed 8.3 LTS update requiring host reboots and rates the impact critical, and Qubes OS says all supported releases are affected with fixed 4.19.6-3 packages. Debian’s security tracker still listed the xen package in bookworm, trixie and forky as vulnerable as of November 4. Xen’s advisory mentions no exploitation in the wild.
References: