CVE-2026-102704 (GCVE-0-2026-102704)

Vulnerability from cvelistv5 – Published: 2026-11-04 10:30 – Updated: 2026-11-04 18:26
VLAI
Title
arbitrary read/write via grant copy
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases: - Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703. - Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704.
Severity
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:26 UTC
CWE
  • CWE-693 - Protection Mechanism Failure
Assigner
XEN CNA under the mitre root
CNA scorecard D 56/100 over 48 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Xen Xen Unknown: consult Xen advisory XSA-523
guessed Create a notification for this product.
Date Public
2026-11-03 12:00
Credits
This issue was discovered by Anthropic using Claude, then validated by Stephan Lipp of Ada Logics. It was then independently reported by the CodeAnt AI Security Research Team.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 4.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-102704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:26:11.558066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T18:26:16.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-523"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from 4.6 onwards are vulnerable.  Xen versions 4.5 and\nearlier are not vulnerable."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Anthropic using Claude, then validated by\nStephan Lipp of Ada Logics.\n\nIt was then independently reported by the CodeAnt AI Security Research\nTeam."
        }
      ],
      "datePublic": "2026-11-03T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nA common access pattern is a batch of Grant Copy operations acting on\nadjacent address ranges in the same source or destination page.  For\nperformance reasons, Xen caches details internally to reuse already\nvalidated data.  The conditions on when to re-validate the internal data\nwere not correct in some cases:\n\n - Frame numbers and grant references could wrongly be mixed up.  This\n   is CVE-2026-102703.\n\n - Copying by frame number (rather than grant reference) is permitted\n   only when operating on the caller\u0027s own memory.  The check to enforce\n   this restriction was misplaced.  This is CVE-2026-102704."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A malicious guest can read and write arbitrary memory, belonging to\nother domains, including Dom0."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T10:30:00.837Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-523.html"
        }
      ],
      "title": "arbitrary read/write via grant copy",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no known mitigation."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-102704",
    "datePublished": "2026-11-04T10:30:00.837Z",
    "dateReserved": "2026-09-29T16:11:40.973Z",
    "dateUpdated": "2026-11-04T18:26:16.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-102704",
      "date": "2026-11-05",
      "epss": "0.00143",
      "percentile": "0.03652"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "Xen",
                "vendor": "Xen",
                "versions": [
                  {
                    "status": "unknown",
                    "version": "consult Xen advisory XSA-523"
                  }
                ]
              }
            ],
            "source": "security@xen.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nA common access pattern is a batch of Grant Copy operations acting on\nadjacent address ranges in the same source or destination page.  For\nperformance reasons, Xen caches details internally to reuse already\nvalidated data.  The conditions on when to re-validate the internal data\nwere not correct in some cases:\n\n - Frame numbers and grant references could wrongly be mixed up.  This\n   is CVE-2026-102703.\n\n - Copying by frame number (rather than grant reference) is permitted\n   only when operating on the caller\u0027s own memory.  The check to enforce\n   this restriction was misplaced.  This is CVE-2026-102704."
          }
        ],
        "id": "CVE-2026-102704",
        "lastModified": "2026-11-04T19:17:17.937",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 4.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 2.5,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-102704",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T18:26:11.558066Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-11-04T11:17:07.303",
        "references": [
          {
            "source": "security@xen.org",
            "url": "https://xenbits.xenproject.org/xsa/advisory-523.html"
          }
        ],
        "sourceIdentifier": "security@xen.org",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-693"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-11-05T13:27:09+00:00",
      "cve": "CVE-2026-102704",
      "id": "CVE-2026-102704",
      "initial_release_date": "2026-11-04T10:30:00.837000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "xen: xen: Privilege escalation via misplaced grant copy validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102704.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "NONE",
                  "baseScore": 4.4,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "LOW",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-102704",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-11-04T18:26:11.558066Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-693",
                    "description": "CWE-693 Protection Mechanism Failure",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-11-04T18:25:14.596Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "product": "Xen",
              "vendor": "Xen",
              "versions": [
                {
                  "status": "unknown",
                  "version": "consult Xen advisory XSA-523"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "value": "All Xen versions from 4.6 onwards are vulnerable.  Xen versions 4.5 and\nearlier are not vulnerable."
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "This issue was discovered by Anthropic using Claude, then validated by\nStephan Lipp of Ada Logics.\n\nIt was then independently reported by the CodeAnt AI Security Research\nTeam."
            }
          ],
          "datePublic": "2026-11-03T12:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nA common access pattern is a batch of Grant Copy operations acting on\nadjacent address ranges in the same source or destination page.  For\nperformance reasons, Xen caches details internally to reuse already\nvalidated data.  The conditions on when to re-validate the internal data\nwere not correct in some cases:\n\n - Frame numbers and grant references could wrongly be mixed up.  This\n   is CVE-2026-102703.\n\n - Copying by frame number (rather than grant reference) is permitted\n   only when operating on the caller\u0027s own memory.  The check to enforce\n   this restriction was misplaced.  This is CVE-2026-102704."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "A malicious guest can read and write arbitrary memory, belonging to\nother domains, including Dom0."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-04T10:30:00.837Z",
            "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
            "shortName": "XEN"
          },
          "references": [
            {
              "url": "https://xenbits.xenproject.org/xsa/advisory-523.html"
            }
          ],
          "title": "arbitrary read/write via grant copy",
          "workarounds": [
            {
              "lang": "en",
              "value": "There is no known mitigation."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "assignerShortName": "XEN",
        "cveId": "CVE-2026-102704",
        "datePublished": "2026-11-04T10:30:00.837Z",
        "dateReserved": "2026-09-29T16:11:40.973Z",
        "dateUpdated": "2026-11-04T18:26:16.031Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.