---
id: CVE-2026-23558
title: |-
  The adjustments made for XSA-379 as well as those subsequently becoming
  XSA-387 still left a race window, when a HVM or PVH guest does a grant
  table version change from v2 to v1 in parallel with mapping the status
  page(s) via XENMEM_add_…
summary: |-
  The adjustments made for XSA-379 as well as those subsequently becoming
  XSA-387 still left a race window, when a HVM or PVH guest does a grant
  table version change from v2 to v1 in parallel with mapping the status
  page(s) via XENMEM_add_…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-362
vendor: xen
product: xen
affected:
  - xen >= 4.0.0
published: '2026-05-19'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23558'
references:
  - url: 'https://xenbits.xenproject.org/xsa/advisory-486.html'
    label: security@xen.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/04/28/13'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://xenbits.xen.org/xsa/advisory-486.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00117
epssPercentile: 0.01575
ingestedAt: '2026-10-14T20:53:12.312Z'
---

## Overview

The adjustments made for XSA-379 as well as those subsequently becoming
XSA-387 still left a race window, when a HVM or PVH guest does a grant
table version change from v2 to v1 in parallel with mapping the status
page(s) via XENMEM_add_to_physmap.  Some of the status pages may then be
freed while mappings of them would still be inserted into the guest's
secondary (P2M) page tables.

## Affected

- `xen >= 4.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.