Xen Hypervisor Flaws Let One Compromised Virtual Machine Take Over the Whole Host

Two flaws in the Xen hypervisor, tracked as CVE-2026-102703 and CVE-2026-102704 under advisory XSA-523, allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host. That includes dom0, the VM that manages the others and has full permissions by default. The Xen Project said on November 3 that patches are available and that there is no known mitigation. All Xen versions from 4.6 onward are affected, while 4.5 and earlier are not. Anthropic was credited with finding the flaws using its Claude model, and the issue was validated by Stephan Lipp of Ada Logics and later independently reported by the CodeAnt AI Security Research Team.

The problem lies in grant copy, the operation Xen uses to copy data between VMs. To save time on a batch of copies within the same memory page, Xen reuses permission checks it has already made, and in some cases it failed to check again when it should have. XCP-ng warned that a single compromised guest can break out of its isolation and take over the whole host. Xen's advisory does not mention any attacks in the wild or say what access inside the VM an attacker needs.

Other products built on Xen are affected until their makers apply the patches. Qubes OS said every supported release is affected, with a fix for Qubes 4.3 in its security-testing repository ahead of a move to stable. As of November 4, Debian listed the xen package as vulnerable in bookworm, trixie and forky, and fixed in sid. XSA-523 is separate from the earlier XSA-500.