CVE-2026-79611— VMX: VMentry failure with branch tracing and blocked states
Quick assessment
Affected
Xen Xen
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
针对 XSA-308，引入了修复逻辑，因为 VMX VM-Entry 检查无法处理当 #DB（调试异常）被拦截、单步执行（Single Stepping）处于激活状态，并且被 STI/MovSS 指令阻塞时出现的特定状态组合。尽管这种状态在合法情况下是可能存在的。由此导致的 VM-Entry 失败会对客户机（guest）造成致命影响。 不幸的是，上述情况还存在一个特殊情况，即启用分支追踪（branch tracing）。在这种情况下，之前的调整仍然会导致 VM-Entry 失败，与前一样会对客户机产生致命影响。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79611
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
VMX: VMentry failure with branch tracing and blocked states
Source: CVE Program / CVE List V5
Vulnerability Description
For XSA-308 logic was introduced, as VMX VMEntry checks do not like the
exact combination of state which occurs when #DB in intercepted, Single
Stepping is active, and blocked by STI/MovSS is active, despite this being
a legitimate state to be in. The resulting VMEntry failure is fatal to
the guest.
Sadly there is another special sub-case of the above, with branch tracing
enabled. In that case the prior adjustment would still cause a VMentry
failure, as before fatal to the guest.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-79611
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79611
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-79611 (1)
Same Patch Batch · Xen · 2026-10-13 · 8 CVEs total
| CVE-2026-102699 | Arm: multiple issues with GNTTABOP_cache_flush | |
| CVE-2026-102700 | gnttab: cache-flush handling may cause page reference leak | |
| CVE-2026-102702 | Arm: multiple issues with GNTTABOP_cache_flush | |
| CVE-2026-79607 | Xenstore: Guests can crash xenstored during Live Update | |
| CVE-2026-79609 | x86: XPTI may break on huge-memory systems | |
| CVE-2026-79610 | grant-table: double version change race | |
| CVE-2026-79608 | x86/AMD: ineffectual Zenbleed workaround |
IV. Related Vulnerabilities
Same product: Xen
-
CVE-2026-102700
gnttab: cache-flush handling may cause page reference leak -
CVE-2026-102702
Arm: multiple issues with GNTTABOP_cache_flush -
CVE-2026-102699
Arm: multiple issues with GNTTABOP_cache_flush -
CVE-2026-79610
grant-table: double version change race -
CVE-2026-79609
x86: XPTI may break on huge-memory systems
Same vendor: Xen
-
CVE-2026-102700
gnttab: cache-flush handling may cause page reference leak -
CVE-2026-102699
Arm: multiple issues with GNTTABOP_cache_flush -
CVE-2026-102702
Arm: multiple issues with GNTTABOP_cache_flush -
CVE-2026-79610
grant-table: double version change race -
CVE-2026-79609
x86: XPTI may break on huge-memory systems
V. Comments for CVE-2026-79611
No comments yet