CVE-2026-23558CWE-362

CVE-2026-23558

High · published May 19, 2026

CVSS v3.1

7.8

EPSS

Percentile

1.6

In the wild

Unconfirmed

What it is

The adjustments made for XSA-379 as well as those subsequently becoming

XSA-387 still left a race window, when a HVM or PVH guest does a grant

table version change from v2 to v1 in parallel with mapping the status

page(s) via XENMEM_add_to_physmap. Some of the status pages may then be

freed while mappings of them would still be inserted into the guest's

secondary (P2M) page tables.

The record

Technical detail

CVSS v3.1: 7.8 · HIGH
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00117 · 1.6th percentile
Weakness: CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published: 2026-05-19T18:16Z

Affected products (1)

Product	Versions	Fixed in
xen/xen	≥ 4.0.0	—

References (3)

EPSS history

Timeline