CVE-2026-79608
Description
A flaw was found in Xen. Due to an inverted conditional check in the handling of processor configuration registers, the software mitigation for the Zenbleed hardware vulnerability is not applied when required. A malicious guest user can exploit this lack of protection to access sensitive data belonging to other virtual machines or the hypervisor, leading to information disclosure.
Statement
A flaw was found in Xen. An inverted conditional in the reworked XSA-433 (Zenbleed) workaround causes the mitigation to not be applied when needed. Exploitation requires AMD Zen2 CPUs with out-of-date microcode; a malicious guest can read data from other contexts on the same core. Red Hat does not ship the Xen hypervisor in supported products; the Fedora community package xen 4.20.4 is in the affected range (XSA-515: 4.20.3+).
Mitigation
update CPU microcode (firmware or amd-ucode from linux-firmware, Zenbleed fix published late 2023); alternatively disable AVX (cpuid=no-avx or cpuid=host:avx=0 per untrusted VM) with significant performance impact; upstream fix patch xsa515.patch exists.
Understanding the Weakness (CWE)
Other
Technical Impact: Alter Execution Logic
This weakness can cause unintended logic to be executed and other unexpected application behavior.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
