Bug 2550647 (CVE-2026-79609)

Summary: CVE-2026-79609 xen: Xen: Denial of Service via guest page table access beyond direct memory mapping
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Xen. A malicious paravirtualized (PV) guest can cause a denial of service (DoS) by crashing the host hypervisor. During Xen Page Table Isolation (XPTI) processing, Xen attempts to access guest root page tables located in memory beyond the direct memory mapping boundary. Attempting to read this unmapped memory causes the hypervisor to fail, rendering the physical host and all hosted virtual machines unavailable.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2559183    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-13 15:51:53 UTC 
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254).  This involves copying 64-bit PV
guest page table entries from guest-chosen root page tables to the Xen-
chosen one which is in actual use by hardware.  To read the guest root
page table, the directmap is used.  PV guests, however, have a directmap
which may not cover all memory; in particular this is the case if any
memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address
boundary.