{"id":"CVE-2026-79608","aliases":["ALPINE-CVE-2026-79608","DEBIAN-CVE-2026-79608","EUVD-2026-98824","GHSA-979q-v7jv-rjpg","SUSE-SU-2026:4942-1","UBUNTU-CVE-2026-79608","openSUSE-SU-2026:12138-1"],"status":"published","title":"x86/AMD: ineffectual Zenbleed workaround","description":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was introduced, resulting in the\nworkaround to not be applied when needed and vice versa.\n\nFor more details, see:\n  http://xenbits.xen.org/xsa/advisory-433.html","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00336,"percentile":0.27361,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-670"],"published":"2026-10-13T15:44:08Z","modified":"2026-11-04T22:04:27Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.19.6-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.20.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.20.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.21.2-r2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.20.4+39-gf1e1321c87-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.20.4+39-gf1e1321c87-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.6-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.2-r2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4+39-gf1e1321c87-0+deb13u1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-0+deb13u1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-0+deb13u1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2","4.20.3+127-gc42374a105-0+deb13u1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4+39-gf1e1321c87-1"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+37-g61ff35323e-1","4.20.2+7-g1badcf5035-1","4.20.2+7-g1badcf5035-2","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4_06-150700.3.49.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4_06-150700.3.49.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2","4.11.3+24-g14b62ab3e5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4+24-gddaaccbbab-1ubuntu2","4.16.0-1~ubuntu2","4.16.0-1~ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.2-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1ubuntu1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1ubuntu2","4.17.3+10-g091466ba55-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.2+7-g1badcf5035-2build2","4.20.2+37-g61ff35323e-1ubuntu1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-2","4.20.2+7-g1badcf5035-2build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.0_06-1.1"}]}],"bundled":5}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-515.html","tags":["report"]},{"url":"http://xenbits.xen.org/xsa/advisory-515.html","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79608"},{"url":"https://github.com/advisories/GHSA-979q-v7jv-rjpg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-79608","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-79608","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264942-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283317","tags":["report"]},{"url":"https://bugzilla.suse.com/1283321","tags":["report"]},{"url":"https://bugzilla.suse.com/1283322","tags":["report"]},{"url":"https://bugzilla.suse.com/1283323","tags":["report"]},{"url":"https://bugzilla.suse.com/1283325","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79611","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-79608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79608","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-515.html","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79607","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-79608","title":"x86/AMD: ineffectual Zenbleed workaround","description":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was introduced, resulting in the\nworkaround to not be applied when needed and vice versa.\n\nFor more details, see:\n  http://xenbits.xen.org/xsa/advisory-433.html","status":"published","published":"2026-10-13T15:44:08.729Z","modified":"2026-10-20T17:36:56.453Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T13:50:38.739766Z"}],"euvd":[{"id":"EUVD-2026-98824","description":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was introduced, resulting in the\nworkaround to not be applied when needed and vice versa.\n\nFor more details, see:\n  http://xenbits.xen.org/xsa/advisory-433.html","status":"published","published":"2026-10-13T15:44:08Z","modified":"2026-10-20T17:36:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:59:43.600473Z"}],"ghsa":[{"id":"GHSA-979q-v7jv-rjpg","title":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate...","description":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was introduced, resulting in the\nworkaround to not be applied when needed and vice versa.\n\nFor more details, see:\n  http://xenbits.xen.org/xsa/advisory-433.html","status":"published","published":"2026-10-13T18:30:51Z","modified":"2026-10-20T18:31:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T15:14:04.153849Z"}],"nvd":[{"id":"CVE-2026-79608","description":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was introduced, resulting in the\nworkaround to not be applied when needed and vice versa.\n\nFor more details, see:\n  http://xenbits.xen.org/xsa/advisory-433.html","status":"published","published":"2026-10-13T16:17:23.04Z","modified":"2026-10-20T18:17:21.973Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:12:57.132005Z"}],"osv":[{"id":"ALPINE-CVE-2026-79608","description":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later\nre-worked to better integrate with other manipulations of the same MSR.\nIn this rework an inverted conditional was introduced, resulting in the\nworkaround to not be applied when needed and vice versa.\n\nFor more details, see:\n  http://xenbits.xen.org/xsa/advisory-433.html","status":"published","published":"2026-10-13T16:17:23.04Z","modified":"2026-10-23T18:30:03.202657344Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"DEBIAN-CVE-2026-79608","description":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa.  For more details, see:   http://xenbits.xen.org/xsa/advisory-433.html","status":"published","published":"2026-10-13T16:17:23.04Z","modified":"2026-11-04T22:04:27.859059878Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T22:39:47.290839Z"},{"id":"UBUNTU-CVE-2026-79608","description":"The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa. For more details, see:   http://xenbits.xen.org/xsa/advisory-433.html","status":"published","published":"2026-10-13T16:17:00Z","modified":"2026-10-28T17:42:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"openSUSE-SU-2026:12138-1","title":"xen-4.22.0_06-1.1 on GA media","description":"These are all security issues fixed in the xen-4.22.0_06-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-14T00:00:00Z","modified":"2026-10-15T17:23:13.673055893Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4942-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2026-79608: x86/AMD: ineffectual Zenbleed workaround (bsc#1283317).\n- CVE-2026-79609: x86: XPTI may break on huge-memory systems (bsc#1283321).\n- CVE-2026-79610: grant-table: double version change race (bsc#1283322).\n- CVE-2026-79611: VMX: VMentry failure with branch tracing and blocked states (bsc#1283323).\n- CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak (bsc#1283325).\n","status":"published","published":"2026-10-29T16:29:02Z","modified":"2026-10-31T18:00:03.930410439Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}