Bug 2567284

Summary: CVE-2026-102704 xen: xen: Privilege escalation via misplaced grant copy validation [fedora-all]
Product: [Fedora] Fedora Reporter: Oleg Sushchenko <osushche>
Component: xenAssignee: Michael Young <m.a.young>
Status: ON_QA --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: jforbes, m.a.young
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["691b25a3-a77b-4f2f-8ec4-b57c6b6685d6"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2566827    

Description Oleg Sushchenko 2026-11-05 12:55:37 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

A common access pattern is a batch of Grant Copy operations acting on
adjacent address ranges in the same source or destination page.  For
performance reasons, Xen caches details internally to reuse already
validated data.  The conditions on when to re-validate the internal data
were not correct in some cases:

 - Frame numbers and grant references could wrongly be mixed up.  This
   is CVE-2026-102703.

 - Copying by frame number (rather than grant reference) is permitted
   only when operating on the caller's own memory.  The check to enforce
   this restriction was misplaced.  This is CVE-2026-102704.
Comment 1 Fedora Update System 2026-11-05 21:29:02 UTC 
FEDORA-2026-0d1924f837 (xen-4.21.2-5.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d1924f837
Comment 2 Fedora Update System 2026-11-05 22:08:39 UTC 
FEDORA-2026-94fa41e927 (xen-4.20.4-5.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-94fa41e927
Comment 3 Fedora Update System 2026-11-06 03:13:23 UTC 
FEDORA-2026-0d1924f837 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-0d1924f837`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d1924f837

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 4 Fedora Update System 2026-11-06 03:33:48 UTC 
FEDORA-2026-94fa41e927 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-94fa41e927`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-94fa41e927

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.