Xen: Stale TLB Entry Ahead of Page Scrubbing (XSA-511)

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

CVE-2026-79603

The Xen hypervisor is vulnerable to a flaw where x86 paravirtualized (PV) guests can free memory pages while a stale Translation Lookaside Buffer (TLB) entry still points to them. Because Xen only issues a TLB flush when a page is reused, a window exists where a PV guest can modify an already scr...

CVE-2026-79603 Unconditionally do TLB flushing ahead of page scrubbing

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

CVE-2026-79603 Unconditionally do TLB flushing ahead of page scrubbing

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

Unconditionally do TLB flushing ahead of page scrubbing

ISSUE DESCRIPTION x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify ...