{"id":"CVE-2026-102704","aliases":["ALPINE-CVE-2026-102704","DEBIAN-CVE-2026-102704","EUVD-2026-116864","GHSA-5425-5qfw-cm7h","SUSE-SU-2026:5087-1","SUSE-SU-2026:5139-1","SUSE-SU-2026:5140-1","SUSE-SU-2026:5159-1","UBUNTU-CVE-2026-102704"],"status":"published","title":"arbitrary read/write via grant copy","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nA common access pattern is a batch of Grant Copy operations acting on\nadjacent address ranges in the same source or destination page.  For\nperformance reasons, Xen caches details internally to reuse already\nvalidated data.  The conditions on when to re-validate the internal data\nwere not correct in some cases:\n\n - Frame numbers and grant references could wrongly be mixed up.  This\n   is CVE-2026-102703.\n\n - Copying by frame number (rather than grant reference) is permitted\n   only when operating on the caller's own memory.  The check to enforce\n   this restriction was misplaced.  This is CVE-2026-102704.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00143,"percentile":0.03655,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2026-11-03T00:00:00Z","modified":"2026-11-10T20:30:04Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.19.6-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.20.4-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.20.4-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.21.2-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.17.7+13-g2445b30a44-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.20.4+63-g7abfd2bce2-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.20.4+63-g7abfd2bce2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.6-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.2-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7+13-g2445b30a44-0+deb12u1"}]}],"versions":["4.17.1+2-gb773c48e36-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1~deb12u1","4.17.2-1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1","4.17.3+10-g091466ba55-1.1~exp1","4.17.3+10-g091466ba55-1.1~exp2","4.17.3+10-g091466ba55-1~deb12u1","4.17.3+36-g54dacb5c02-1","4.17.5+23-ga4e5191dc0-1","4.17.5+23-ga4e5191dc0-1+deb12u1","4.17.5+72-g01140da4e8-1","4.17.7-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4+63-g7abfd2bce2-0+deb13u1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-0+deb13u1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-0+deb13u1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2","4.20.3+127-gc42374a105-0+deb13u1","4.20.3+127-gc42374a105-1","4.20.4+39-gf1e1321c87-0+deb13u1","4.20.4+39-gf1e1321c87-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4+63-g7abfd2bce2-1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2","4.20.3+127-gc42374a105-1","4.20.4+39-gf1e1321c87-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4_08-150700.3.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4_08-150700.3.52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_78-3.157.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_78-3.157.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.6_03-150600.3.56.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.6_03-150600.3.56.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7_04-150500.3.85.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7_04-150500.3.85.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7_04-150500.3.85.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7_04-150500.3.85.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.7_04-150500.3.85.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2","4.11.3+24-g14b62ab3e5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4+24-gddaaccbbab-1ubuntu2","4.16.0-1~ubuntu2","4.16.0-1~ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.2-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1ubuntu1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1ubuntu2","4.17.3+10-g091466ba55-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.2+7-g1badcf5035-2build2","4.20.2+37-g61ff35323e-1ubuntu1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-2","4.20.2+7-g1badcf5035-2build2"]}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-523.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102704"},{"url":"https://github.com/advisories/GHSA-5425-5qfw-cm7h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-102704","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-102704","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265087-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1288663","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102704","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265139-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276838","tags":["report"]},{"url":"https://bugzilla.suse.com/1276839","tags":["report"]},{"url":"https://bugzilla.suse.com/1276841","tags":["report"]},{"url":"https://bugzilla.suse.com/1283321","tags":["report"]},{"url":"https://bugzilla.suse.com/1283322","tags":["report"]},{"url":"https://bugzilla.suse.com/1283323","tags":["report"]},{"url":"https://bugzilla.suse.com/1283325","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79611","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265159-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-102704","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102704","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-523.html","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-102704","title":"arbitrary read/write via grant copy","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nA common access pattern is a batch of Grant Copy operations acting on\nadjacent address ranges in the same source or destination page.  For\nperformance reasons, Xen caches details internally to reuse already\nvalidated data.  The conditions on when to re-validate the internal data\nwere not correct in some cases:\n\n - Frame numbers and grant references could wrongly be mixed up.  This\n   is CVE-2026-102703.\n\n - Copying by frame number (rather than grant reference) is permitted\n   only when operating on the caller's own memory.  The check to enforce\n   this restriction was misplaced.  This is CVE-2026-102704.","status":"published","published":"2026-11-04T10:30:00.837Z","modified":"2026-11-04T18:26:16.031Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-693"],"updated_at":"2026-11-04T19:37:11.438172Z"}],"euvd":[{"id":"EUVD-2026-116864","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nA common access pattern is a batch of Grant Copy operations acting on\nadjacent address ranges in the same source or destination page.  For\nperformance reasons, Xen caches details internally to reuse already\nvalidated data.  The conditions on when to re-validate the internal data\nwere not correct in some cases:\n\n - Frame numbers and grant references could wrongly be mixed up.  This\n   is CVE-2026-102703.\n\n - Copying by frame number (rather than grant reference) is permitted\n   only when operating on the caller's own memory.  The check to enforce\n   this restriction was misplaced.  This is CVE-2026-102704.","status":"published","published":"2026-11-04T10:30:00Z","modified":"2026-11-04T18:26:16Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-04T19:12:51.694741Z"}],"ghsa":[{"id":"GHSA-5425-5qfw-cm7h","title":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects...","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nA common access pattern is a batch of Grant Copy operations acting on\nadjacent address ranges in the same source or destination page.  For\nperformance reasons, Xen caches details internally to reuse already\nvalidated data.  The conditions on when to re-validate the internal data\nwere not correct in some cases:\n\n - Frame numbers and grant references could wrongly be mixed up.  This\n   is CVE-2026-102703.\n\n - Copying by frame number (rather than grant reference) is permitted\n   only when operating on the caller's own memory.  The check to enforce\n   this restriction was misplaced.  This is CVE-2026-102704.","status":"published","published":"2026-11-04T12:31:30Z","modified":"2026-11-04T21:32:26Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-04T21:42:45.289646Z"}],"nvd":[{"id":"CVE-2026-102704","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nA common access pattern is a batch of Grant Copy operations acting on\nadjacent address ranges in the same source or destination page.  For\nperformance reasons, Xen caches details internally to reuse already\nvalidated data.  The conditions on when to re-validate the internal data\nwere not correct in some cases:\n\n - Frame numbers and grant references could wrongly be mixed up.  This\n   is CVE-2026-102703.\n\n - Copying by frame number (rather than grant reference) is permitted\n   only when operating on the caller's own memory.  The check to enforce\n   this restriction was misplaced.  This is CVE-2026-102704.","status":"published","published":"2026-11-04T11:17:07.303Z","modified":"2026-11-06T19:36:46.543Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-06T22:02:16.68777Z"}],"osv":[{"id":"ALPINE-CVE-2026-102704","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nA common access pattern is a batch of Grant Copy operations acting on\nadjacent address ranges in the same source or destination page.  For\nperformance reasons, Xen caches details internally to reuse already\nvalidated data.  The conditions on when to re-validate the internal data\nwere not correct in some cases:\n\n - Frame numbers and grant references could wrongly be mixed up.  This\n   is CVE-2026-102703.\n\n - Copying by frame number (rather than grant reference) is permitted\n   only when operating on the caller's own memory.  The check to enforce\n   this restriction was misplaced.  This is CVE-2026-102704.","status":"published","published":"2026-11-04T11:17:07.303Z","modified":"2026-11-05T09:30:02.588396744Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T13:31:49.170436Z"},{"id":"DEBIAN-CVE-2026-102704","description":"[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]  A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page.  For performance reasons, Xen caches details internally to reuse already validated data.  The conditions on when to re-validate the internal data were not correct in some cases:   - Frame numbers and grant references could wrongly be mixed up.  This    is CVE-2026-102703.   - Copying by frame number (rather than grant reference) is permitted    only when operating on the caller's own memory.  The check to enforce    this restriction was misplaced.  This is CVE-2026-102704.","status":"published","published":"2026-11-04T11:17:07.303Z","modified":"2026-11-09T14:00:07.704022603Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-09T14:31:39.434822Z"},{"id":"UBUNTU-CVE-2026-102704","description":"[Unknown description]","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-06T01:00:27.806900412Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T01:33:05.666804Z"},{"id":"SUSE-SU-2026:5087-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2026-102703,CVE-2026-102704: arbitrary read/write via grant copy (bsc#1288663).\n\nNon security issue fixed:\n\n- Xen: Missing upstream bug fixes (bsc#1027519).\n","status":"published","published":"2026-11-03T13:45:03Z","modified":"2026-11-04T14:15:13.621650228Z","updated_at":"2026-11-04T14:31:33.296313Z"},{"id":"SUSE-SU-2026:5139-1","title":"Security update for xen","description":"This update for xen fixes the following issue:\n\n- CVE-2026-102703,CVE-2026-102704: arbitrary read/write via grant copy (bsc#1288663).\n","status":"published","published":"2026-11-09T13:02:54Z","modified":"2026-11-10T13:15:10.655281253Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"SUSE-SU-2026:5140-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).\n- CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).\n- CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).\n- CVE-2026-79609: x86: XPTI may break on huge-memory systems (bsc#1283321).\n- CVE-2026-79610: grant-table: double version change race (bsc#1283322).\n- CVE-2026-79611: VMX: VMentry failure with branch tracing and blocked states (bsc#1283323).\n- CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak (bsc#1283325).\n- CVE-2026-102703,CVE-2026-102704: arbitrary read/write via grant copy (bsc#1288663).\n\nNon security issue fixed:\n\n- Update to Xen 4.18.6 security bug fix release (bsc#1027519).\n","status":"published","published":"2026-11-09T13:24:47Z","modified":"2026-11-10T13:15:07.782924083Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"SUSE-SU-2026:5159-1","title":"Security update for xen","description":"This update for xen fixes the following issue:\n\n- CVE-2026-102703,CVE-2026-102704: arbitrary read/write via grant copy (bsc#1288663).\n","status":"published","published":"2026-11-10T09:35:47Z","modified":"2026-11-10T20:30:04.869709743Z","updated_at":"2026-11-10T20:43:04.310349Z"}]}}