Xen discloses XSA-523 grant copy flaws exposing other VMs and dom0 memory

What happened

The Xen Project disclosed two flaws in the hypervisor’s grant copy implementation on November 3, according to The Hacker News, which reports that they let a malicious guest VM read and write the memory of other VMs on the same host, including dom0. Vates, which backs XCP-ng, says in its own advisory that “a malicious guest can read and write arbitrary memory, belonging to other domains, including Dom0” and rates the impact for its products as Critical Vates.

The flaws are tracked as CVE-2026-102703 and CVE-2026-102704 under Xen advisory XSA-523. Vates describes the root cause: for batches of grant copy operations on the same page, Xen caches already validated data, and the conditions for re-validating it were wrong in some cases Vates:

• CVE-2026-102703: frame numbers and grant references could wrongly be mixed up.
• CVE-2026-102704: the check restricting copy-by-frame-number to the caller’s own memory was misplaced.

Vates says there are no known mitigations. The issue was discovered by Anthropic using Claude, validated by Stephan Lipp of Ada Logics, and independently reported by the CodeAnt AI Security Research Team Vates.

CodeAnt AI published a write-up on November 4 describing a guest-to-dom0 escape on XenServer 9, according to The Hacker News. Per that report, CodeAnt’s proof used CVE-2026-102704 only, one exact XenServer dom0 kernel image and a single CPU, started from kernel-level control inside a PVH or HVM guest on x86, and reached the dom0 Linux kernel rather than Xen’s own code. CodeAnt’s own CVSS assessment is 9.3 (v3.1) and 9.4 (v4.0); Vates lists its CVSS 4.0 score as not yet available Vates.

What is not confirmed: exploitation in the wild (The Hacker News says Xen’s advisory mentions no attacks), and the in-guest access an attacker needs according to Xen itself, which The Hacker News says the advisory does not specify.

XSA-523 is separate from XSA-500, an earlier grant copy flaw, and has its own patches The Hacker News.

Am I affected?

According to The Hacker News:

• All Xen versions from 4.6 onward are vulnerable; 4.5 and earlier are not.
• Xen 4.6 to 4.16 get no patch in the advisory; Xen 4.16 security support ended on December 2, 2024.
• Qubes OS says every supported release and configuration is affected; the fix targets Qubes 4.3.
• As of November 4, Debian’s security tracker listed xen in bookworm, trixie and forky as vulnerable and in sid as fixed.
• Other products built on Xen 4.6 or later stay affected until their makers ship the XSA-523 patches.

Vates lists XCP-ng 8.3 as affected Vates.

What to do now

1. XCP-ng 8.3: update to xen-4.17.7-4.2.xcpng8.3 and reboot the hosts Vates, The Hacker News.
2. Qubes OS 4.3: install Xen packages 4.19.6-3 in dom0 and restart dom0. Anti Evil Maid users must reseal their secret passphrase because PCR18 and PCR19 change. Qubes says the fix was first in its security-testing repository and due to move to stable over about two weeks The Hacker News.
3. Xen built from source: apply the XSA-523 patches, available for Xen 4.17.x through xen-unstable The Hacker News.
4. Xen 4.6 to 4.16: no patch is published; plan an upgrade to a supported branch The Hacker News.
5. Debian and other Xen-based products: track your vendor’s tracker for the XSA-523 fix and update when it lands The Hacker News.

Sources

• Vates: VSA-2026-055: arbitrary read/write via grant copy (CVE-2026-102703, CVE-2026-102704 / XSA-523)
• The Hacker News: Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM’s Memory