CVE-2026-102702

HighCVSS 7.5/10Last modified Oct 20, 2026

Description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor.

This is CVE-2026-102699.

2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory.

This is CVE-2026-102702.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-191

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Xen	Xen	—

References

https://xenbits.xenproject.org/xsa/advisory-519.html

Timeline

Published: Oct 13, 2026
Last modified: Oct 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1027034.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common a CVE-2026-1027044.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common a CVE-2026-1027098.4In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports derefer CVE-2026-102716.3A flaw has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The affected element is an unknown f CVE-2026-1027108.5In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protec CVE-2026-1027116.9In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the size CVE-2026-1027126.3In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with DTLS server support, the NetX Secure DTLS server's ClientH CVE-2026-1027138.3In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length CVE-2026-1027147.1In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area t CVE-2026-1027157.1In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for CVE-2026-1027168.7In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session he CVE-2026-1027177.5MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash