CVE-2026-23554

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23554
The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.1 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://xenbits.xenproject.org/xsa/advisory-480.html Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/17/6 Mailing List Patch Third Party Advisory
http://xenbits.xen.org/xsa/advisory-480.html Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*
History

10 Apr 2026, 20:40

Type Values Removed Values Added
References () https://xenbits.xenproject.org/xsa/advisory-480.html - () https://xenbits.xenproject.org/xsa/advisory-480.html - Patch, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/03/17/6 - () http://www.openwall.com/lists/oss-security/2026/03/17/6 - Mailing List, Patch, Third Party Advisory
References () http://xenbits.xen.org/xsa/advisory-480.html - () http://xenbits.xen.org/xsa/advisory-480.html - Patch, Vendor Advisory
Summary
  • (es) El código de paginación EPT de Intel utiliza una optimización para aplazar el vaciado de cualquier estado EPT en caché hasta que se libere el bloqueo p2m, de modo que múltiples modificaciones realizadas bajo la misma región bloqueada solo emitan un único vaciado. La liberación de estructuras de paginación, sin embargo, no se aplaza hasta que se complete el vaciado, y puede resultar en que las páginas liberadas estén transitoriamente presentes en estado de caché. Dichas entradas obsoletas pueden apuntar a rangos de memoria no poseídos por el invitado, permitiendo así el acceso a regiones de memoria no intencionadas.
First Time Xen
Xen xen
CPE cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*

23 Mar 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-367

23 Mar 2026, 08:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/03/17/6 -
  • () http://xenbits.xen.org/xsa/advisory-480.html -

23 Mar 2026, 07:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-23 07:16

Updated : 2026-04-10 20:40

NVD link : CVE-2026-23554

Mitre link : CVE-2026-23554

CVE.ORG link : CVE-2026-23554

JSON object : View

Products Affected

xen

  • xen
CWE
CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition