The Xen Project published advisory XSA-523 on 3 November, covering two flaws in how the hypervisor handles Grant Copy operations that let a malicious guest read and write memory belonging to other domains, Dom0 included.
The advisory assigns CVE-2026-102703 and CVE-2026-102704. Xen caches validated data so that a batch of Grant Copy operations on adjacent address ranges can reuse it. The conditions for re-validating that cache “were not correct in some cases,” according to the advisory. In the first flaw, frame numbers and grant references could be mixed up. In the second, the check that limits copying by frame number to the caller’s own memory was misplaced.
The impact line is direct: “A malicious guest can read and write arbitrary memory, belonging to other domains, including Dom0.” All Xen versions from 4.6 onward are vulnerable, and 4.5 and earlier are not. The advisory states that there is no known mitigation.
The advisory credits Anthropic, using Claude, with the discovery, validated by Stephan Lipp of Ada Logics and independently reported by the CodeAnt AI Security Research Team. Patches are attached for xen-unstable through 4.19.x and for 4.18.x through 4.17.x. The Xen Project advises downstreams to update to the tip of the stable branch before applying them, because the patches may not apply cleanly to the latest tarball.
With no workaround, patching is the only control, so the first job is knowing which hosts run Xen and which build each carries, including hosts a provider manages for you. The Xen security index also lists XSA-529 and XSA-530 as assigned and embargoed, with public release set for 10 November at 18:00 UTC, so a second patch cycle is already on the calendar.
In our reading, the guest-to-host boundary deserves the same urgency as an edge appliance flaw, because the attacker needs only a tenant. We reported the same class of problem when a Linux kernel bug let VMs read host memory and when VMware patched flaws that break host isolation. Environments that rent capacity to untrusted users should patch first.
Source: Xen Project, XSA-523
