---
id: CVE-2026-79603
title: |-
  x86 PV guests can free memory pages while still keeping a stale TLB entry
  pointing to them
summary: |-
  x86 PV guests can free memory pages while still keeping a stale TLB entry
  pointing to them.  A TLB flush is only issued by Xen (if needed) when the
  page is re-used.  Since it's possible for the page to be scrubbed ahead of
  the TLB flush,…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-664
vendor: Xen
product: Xen
affected:
  - Xen
published: '2026-09-08'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T19:20:25.117'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79603'
references:
  - url: 'https://xenbits.xenproject.org/xsa/advisory-511.html'
    label: security@xen.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/08/8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://xenbits.xen.org/xsa/advisory-511.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T13:42:37.092287Z'
ingestedAt: '2026-09-08T15:33:26.984Z'
epss: 0.00361
epssPercentile: 0.27203
---

## Overview

x86 PV guests can free memory pages while still keeping a stale TLB entry
pointing to them.  A TLB flush is only issued by Xen (if needed) when the
page is re-used.  Since it's possible for the page to be scrubbed ahead of
the TLB flush, there's a window where a PV guest can modify an already
scrubbed page.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.