Bug 2550646 (CVE-2026-102699)

Summary:	CVE-2026-102699 xen: xen: Denial of Service via integer underflow during cache flushing
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Xen. A malicious guest domain can trigger an integer underflow when requesting cache flush operations. This calculation error leads to an excessively long processing loop in the hypervisor, causing the host system to crash and resulting in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2558257
Bug Blocks:

Description OSIDB Bzimport 2026-10-13 15:51:39 UTC

[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
   calculations involved in guests flushing caches through
   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a
   calculation which may underflow, resulting in a loop which would - at
   least on 64-bit Arm - take excessively long, and which would likely
   eventually crash the hypervisor.

   This is CVE-2026-102699.

2) GNTTABOP_cache_flush may be issued on memory mapped from another
   domain using the grant table interface.  However there was no
   restriction to disallow the use of invalidate-without-clean against
   read-only grant mappings, which may corrupt the granted memory.

   This is CVE-2026-102702.