grant-table: double version change race
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.
CVE-2026-79610
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-79610
Xen
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Xen",
"product": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-517"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-79610
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #42422 · Revision 1
- Added to Heist Feed
- Publisher date