CVE-2026-23554 Details
Description
The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.
A use-after-free vulnerability has been identified in the Intel Extended Page Tables (EPT) handling within Xen hypervisor versions 4.17 and later. This issue arises because the EPT paging code optimizes performance by delaying the flushing of cached EPT state until after the page-to-machine (p2m) lock is released. While this optimization allows multiple modifications to be consolidated into a single flush, it inadvertently creates a window where freed paging structures can temporarily remain in a cached state. These stale entries may reference memory areas not allocated to the guest, potentially granting access to unauthorized memory regions. The vulnerability can be exploited by x86 HVM/PVH guests using Hardware-Assisted Paging (HAP) on affected systems.
Applying the provided patch resolves this vulnerability. Note that this patch is intended for the stable branches of Xen 4.17.x. Instructions for applying the patch can be found in the Xen Security Advisory XSA-480.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/03/17/6 | CVE | Mailing ListPatchThird Party Advisory |
| http://xenbits.xen.org/xsa/advisory-480.html | CVE | PatchVendor Advisory |
| https://xenbits.xenproject.org/xsa/advisory-480.html | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| xen xen | >= 4.17 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | CVE Modified | CVE |
| Mar 23, 2026 | New CVE Received | [email protected] |