SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-79603

MEDIUM · CVSS 4.3 EPSS 0.23%

Source: NVD + CISA KEV + EPSS · Published 2026-09-08 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

X86 paravirtualized (PV) guests are vulnerable to a memory management issue that allows them to free memory pages while retaining stale Translation Lookaside Buffer (TLB) entries. This creates a risk where a guest can potentially modify a memory page that has already been scrubbed, leading to data integrity concerns. Organizations utilizing Xen hypervisors with x86 PV guests should prioritize addressing this vulnerability to mitigate potential exploitation risks.

CVE
CVE-2026-79603
Severity
MEDIUM
CVSS
4.3
EPSS
0.23%

Original NVD Description

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.