CVE-2026-102699
Description
A flaw was found in Xen. A malicious guest domain can trigger an integer underflow when requesting cache flush operations. This calculation error leads to an excessively long processing loop in the hypervisor, causing the host system to crash and resulting in a Denial of Service (DoS).
Statement
A denial-of-service flaw of moderate severity was found in the Xen hypervisor's handling of guest-requested cache flush operations. The fix for XSA-437 (CVE-2023-34321) introduced a calculation that may underflow when a guest issues GNTTABOP_cache_flush hypercalls. An unprivileged malicious guest can trigger this integer underflow to drive an excessively long processing loop in the hypervisor that will likely eventually crash the host, resulting in a denial of service affecting the entire host and all guests running on it. Only Arm systems are vulnerable (the excessive loop behavior is confirmed on 64-bit Arm); x86 systems are not affected. Red Hat has rated this flaw as moderate impact with a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Within the Red Hat portfolio, the community-supported Fedora xen package is affected and a fix is being pursued through the upstream Xen project; no supported Red Hat products are listed as affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
