Vulnerability Report

CVE-2026-23558

Title: Race Condition in Xen Grant Table Version Change

Vulnerability

Proof Of Concept

No public PoC currently indexed for CVE-2026-23558.

CWE Category NVD-CWE-noinfo

Published Date May 19, 2026

Modified Date May 19, 2026

Exploit Status Not Found

Score 7.8 CVSS v

Exploit Probability (EPSS)

0.12%

Vulnerability Summary

CVE-2026-23558: The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of the status pages may then be freed while mappings of them would still be inserted into the guest's secondary (P2M) page tables.

Impacted Vendors

xensource_inc 1

xen 1

Reference Links

https://xenbits.xenproject.org/xsa/advisory-486.html http://www.openwall.com/lists/oss-security/2026/04/28/13 http://xenbits.xen.org/xsa/advisory-486.html

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity HIGH

7.8

Attack Vector

LOCAL

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-23558 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

May 19, 2026 MODIFIED

Vulnerability data updated via NVD.

May 19, 2026 MODIFIED

Vulnerability data updated via NVD.

May 19, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector LOCAL

Complexity HIGH

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Stack

No specific products linked.