CVE-2026-102700
Description
A flaw was found in Xen. An error handling issue in the grant table cache flush operation fails to properly release memory page references when handling pages owned by special system domains. A guest domain can exploit this flaw to cause a reference leak, potentially leading to resource exhaustion and a Denial of Service (DoS) on the host.
Statement
A moderate-impact denial-of-service flaw was found in the Xen hypervisor's grant table cache-flush handling. The error path introduced alongside the NULL pointer check added for XSA-232 fails to drop a page reference when the page specified in a GNTTAB_cache_flush request is owned by a special system domain such as DOM_IO or DOM_COW. A guest running on an affected x86 host can repeatedly issue such cache-flush requests to leak page references, eventually exhausting memory resources and causing a denial of service against Domain 0 or another domain, which can affect the entire host. Arm systems are not vulnerable. Within Red Hat's product scope, only the community-maintained Fedora xen package is tracked as affected, with resolution delegated to the Fedora community; a fix based on the upstream XSA-520 patch is being pursued there.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
If an adversary can prevent a reference count from reaching zero, then resources might not be released when they are supposed to, thus causing resources to become scarce for future needs.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If an adversary can cause a reference count to reach zero when the resource is still in use, then a resource might be released before it is supposed to be, possibly forcing an error that causes the product to crash or exit out of its current operation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
