Bug 2566827 (CVE-2026-102704)

Summary:	CVE-2026-102704 xen: xen: Privilege escalation via misplaced grant copy validation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Xen. An unprivileged guest domain can bypass memory isolation controls during batched grant copy operations, which are used to share memory between virtual machines. Due to a misplaced validation check when reusing cached memory verification details, Xen permits memory copying by frame number outside of the caller's own assigned memory. A malicious guest could exploit this vulnerability to read or overwrite unauthorized memory, potentially leading to privilege escalation, information disclosure, or a denial of service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2567284
Bug Blocks:

Description OSIDB Bzimport 2026-11-04 10:42:37 UTC

[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

A common access pattern is a batch of Grant Copy operations acting on
adjacent address ranges in the same source or destination page.  For
performance reasons, Xen caches details internally to reuse already
validated data.  The conditions on when to re-validate the internal data
were not correct in some cases:

 - Frame numbers and grant references could wrongly be mixed up.  This
   is CVE-2026-102703.

 - Copying by frame number (rather than grant reference) is permitted
   only when operating on the caller's own memory.  The check to enforce
   this restriction was misplaced.  This is CVE-2026-102704.