CVE-2026-102702— Arm: multiple issues with GNTTABOP_cache_flush
Quick assessment
Affected
Xen Xen
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
[此 CNA 信息记录涉及多个 CVE；以下文本说明了各个方面/漏洞分别对应哪个 CVE。] 1) XSA-437（CVE-2023-34321）解决了通过 GNTTABOP_cache_flush 操作让访客（guest）刷新缓存时，相关计算中存在的溢出问题。不幸的是，该修复引入了一项可能导致下溢的计算，从而引发一个循环。该循环至少在 64 位 Arm 架构上会持续异常长的时间，并极有可能最终导致 hypervisor（虚拟机监视器）崩溃。 该问题对应 CVE-2026-102699。 2) GNTTABOP_c
Possible ATT&CK Techniques 2 AI
T1498.001 · Direct Network Flood T1499.002 · Service Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102702
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Arm: multiple issues with GNTTABOP_cache_flush
Source: CVE Program / CVE List V5
Vulnerability Description
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
calculations involved in guests flushing caches through
GNTTABOP_cache_flush. Unfortunately the fix there introduced a
calculation which may underflow, resulting in a loop which would - at
least on 64-bit Arm - take excessively long, and which would likely
eventually crash the hypervisor.
This is CVE-2026-102699.
2) GNTTABOP_cache_flush may be issued on memory mapped from another
domain using the grant table interface. However there was no
restriction to disallow the use of invalidate-without-clean against
read-only grant mappings, which may corrupt the granted memory.
This is CVE-2026-102702.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-102702
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102702
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-102702 (1)
Same Patch Batch · Xen · 2026-10-13 · 8 CVEs total
| CVE-2026-102699 | Arm: multiple issues with GNTTABOP_cache_flush | |
| CVE-2026-102700 | gnttab: cache-flush handling may cause page reference leak | |
| CVE-2026-79607 | Xenstore: Guests can crash xenstored during Live Update | |
| CVE-2026-79611 | VMX: VMentry failure with branch tracing and blocked states | |
| CVE-2026-79609 | x86: XPTI may break on huge-memory systems | |
| CVE-2026-79610 | grant-table: double version change race | |
| CVE-2026-79608 | x86/AMD: ineffectual Zenbleed workaround |
IV. Related Vulnerabilities
Same product: Xen
-
CVE-2026-102700
gnttab: cache-flush handling may cause page reference leak -
CVE-2026-102699
Arm: multiple issues with GNTTABOP_cache_flush -
CVE-2026-79611
VMX: VMentry failure with branch tracing and blocked states -
CVE-2026-79610
grant-table: double version change race -
CVE-2026-79609
x86: XPTI may break on huge-memory systems
Same vendor: Xen
-
CVE-2026-102700
gnttab: cache-flush handling may cause page reference leak -
CVE-2026-102699
Arm: multiple issues with GNTTABOP_cache_flush -
CVE-2026-79611
VMX: VMentry failure with branch tracing and blocked states -
CVE-2026-79610
grant-table: double version change race -
CVE-2026-79609
x86: XPTI may break on huge-memory systems
V. Comments for CVE-2026-102702
No comments yet