Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102700— gnttab: cache-flush handling may cause page reference leak

Quick assessment

Affected
Xen Xen
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 GNTTAB_cache_flush 最初引入时，它是被一致地提供的。随后，XSA-232（CVE-2017-14318）覆盖了其中遗漏的空指针检查问题，但添加该检查后并未对后续的错误处理路径进行相应调整。该错误处理路径在指定页面属于特殊系统域（如 DOM_IO 和 DOM_COW，这些是可以分配内存页面的系统域）时，未能正确释放该页面的引用计数。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 1

VendorProduct Version RangeStatus
Xen Xen consult Xen advisory XSA-520 unknown
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102700

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
gnttab: cache-flush handling may cause page reference leak
Source: CVE Program / CVE List V5
Vulnerability Description
With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOM_IO and DOM_COW are system domains which can have memory pages assigned to them.)
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Xen Xen consult Xen advisory XSA-520 -

II. Public POCs for CVE-2026-102700

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102700

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-102700 (1)

Same Patch Batch · Xen · 2026-10-13 · 8 CVEs total

CVE-2026-102699 Arm: multiple issues with GNTTABOP_cache_flush
CVE-2026-102702 Arm: multiple issues with GNTTABOP_cache_flush
CVE-2026-79607 Xenstore: Guests can crash xenstored during Live Update
CVE-2026-79611 VMX: VMentry failure with branch tracing and blocked states
CVE-2026-79609 x86: XPTI may break on huge-memory systems
CVE-2026-79610 grant-table: double version change race
CVE-2026-79608 x86/AMD: ineffectual Zenbleed workaround

IV. Related Vulnerabilities

Same product: Xen
Same vendor: Xen

V. Comments for CVE-2026-102700

No comments yet

Leave a comment