CVE-2026-102702

[This CNA information record relates to multiple CVEs; the

text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in

calculations involved in guests flushing caches through

GNTTABOP_cache_flush. Unfortunately the fix there introduced a

calculation which may underflow, resulting in a loop which would - at

least on 64-bit Arm - take excessively long, and which would likely

eventually crash the hypervisor.

This is CVE-2026-102699.

2) GNTTABOP_cache_flush may be issued on memory mapped from another

domain using the grant table interface. However there was no

restriction to disallow the use of invalidate-without-clean against

read-only grant mappings, which may corrupt the granted memory.

This is CVE-2026-102702.