ALPINE-CVE-2026-23554
The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.
ALPINE-CVE-2026-23554
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALPINE-CVE-2026-23554
xen
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.18.5-r5
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
xen
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.19.4-r2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
xen
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.20.2-r2
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
xen
Source reference: /affected/3/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.20.2-r2
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
xen
Source reference: /affected/4/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.21.0-r3
Source reference:
/affected/4/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.17"
},
{
"fixed": "4.18.5-r5"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-23554.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.17"
},
{
"fixed": "4.19.4-r2"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-23554.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.17"
},
{
"fixed": "4.20.2-r2"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-23554.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.17"
},
{
"fixed": "4.20.2-r2"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-23554.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.17"
},
{
"fixed": "4.21.0-r3"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-23554.json"
},
"ecosystem_specific": {}
}
]Publisher severity
No explicit severity was provided.
- Event
- #54178 · Revision 1
- Added to Heist Feed
- Publisher date