{"api_version":"1","generated_at":"2026-10-14T19:45:58+00:00","cve":"CVE-2026-102699","urls":{"html":"https://cve.report/CVE-2026-102699","api":"https://cve.report/api/cve/CVE-2026-102699.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-102699","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102699"},"summary":{"title":"Arm: multiple issues with GNTTABOP_cache_flush","description":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n   calculations involved in guests flushing caches through\n   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a\n   calculation which may underflow, resulting in a loop which would - at\n   least on 64-bit Arm - take excessively long, and which would likely\n   eventually crash the hypervisor.\n\n   This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n   domain using the grant table interface.  However there was no\n   restriction to disallow the use of invalidate-without-clean against\n   read-only grant mappings, which may corrupt the granted memory.\n\n   This is CVE-2026-102702.","state":"PUBLISHED","assigner":"XEN","published_at":"2026-10-13 16:17:09","updated_at":"2026-10-14 16:10:14"},"problem_types":[],"metrics":[],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-519.html","name":"https://xenbits.xenproject.org/xsa/advisory-519.html","refsource":"security@xen.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102699","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102699","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Xen","product":"Xen","version":"unknown consult Xen advisory XSA-519","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"There is no known mitigation.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"CVE-2026-102699 was discovered by Leonid Komarianskyi of EPAM.  It was\nlater independently reported by Ayan Kumar Halder of AMD.\n\nCVE-2026-102702 was found by the security team while looking at the\nsurrounding code.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Xen","vendor":"Xen","versions":[{"status":"unknown","version":"consult Xen advisory XSA-519"}]}],"configurations":[{"lang":"en","value":"All Xen versions from 4.5 onwards are vulnerable.  Xen versions 4.4 and\nearlier are not vulnerable.\n\nOnly Arm systems are vulnerable.  x86 systems are not vulnerable."}],"credits":[{"lang":"en","type":"finder","value":"CVE-2026-102699 was discovered by Leonid Komarianskyi of EPAM.  It was\nlater independently reported by Ayan Kumar Halder of AMD.\n\nCVE-2026-102702 was found by the security team while looking at the\nsurrounding code."}],"datePublic":"2026-10-13T12:00:00.000Z","descriptions":[{"lang":"en","value":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n   calculations involved in guests flushing caches through\n   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a\n   calculation which may underflow, resulting in a loop which would - at\n   least on 64-bit Arm - take excessively long, and which would likely\n   eventually crash the hypervisor.\n\n   This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n   domain using the grant table interface.  However there was no\n   restriction to disallow the use of invalidate-without-clean against\n   read-only grant mappings, which may corrupt the granted memory.\n\n   This is CVE-2026-102702."}],"impacts":[{"descriptions":[{"lang":"en","value":"A malicious unprivileged guest may crash the hypervisor, causing a\nDenial of Service (DoS) affecting the entire host, or corrupt memory\nbelonging to another domain.  Privilege escalation and information leaks\ncannot be ruled out."}]}],"providerMetadata":{"dateUpdated":"2026-10-13T15:45:13.073Z","orgId":"23aa2041-22e1-471f-9209-9b7396fa234f","shortName":"XEN"},"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-519.html"}],"title":"Arm: multiple issues with GNTTABOP_cache_flush","workarounds":[{"lang":"en","value":"There is no known mitigation."}]}},"cveMetadata":{"assignerOrgId":"23aa2041-22e1-471f-9209-9b7396fa234f","assignerShortName":"XEN","cveId":"CVE-2026-102699","datePublished":"2026-10-13T15:45:13.073Z","dateReserved":"2026-09-29T16:11:40.973Z","dateUpdated":"2026-10-13T15:45:13.073Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-13 16:17:09","lastModifiedDate":"2026-10-14 16:10:14","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"102699","Ordinal":"1","Title":"Arm: multiple issues with GNTTABOP_cache_flush","CVE":"CVE-2026-102699","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"102699","Ordinal":"1","NoteData":"[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\n1) XSA-437 (CVE-2023-34321) addressed issues with overflows in\n   calculations involved in guests flushing caches through\n   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a\n   calculation which may underflow, resulting in a loop which would - at\n   least on 64-bit Arm - take excessively long, and which would likely\n   eventually crash the hypervisor.\n\n   This is CVE-2026-102699.\n\n2) GNTTABOP_cache_flush may be issued on memory mapped from another\n   domain using the grant table interface.  However there was no\n   restriction to disallow the use of invalidate-without-clean against\n   read-only grant mappings, which may corrupt the granted memory.\n\n   This is CVE-2026-102702.","Type":"Description","Title":"Arm: multiple issues with GNTTABOP_cache_flush"}]}}}