Two security flaws in the Xen hypervisor allow a malicious guest virtual machine to read and write the memory of other virtual machines on the same host, according to a recent report by The Hacker News.
The vulnerabilities, tracked as CVE-2026-102703 and CVE-2026-102704, affect all Xen versions from 4.6 onward. The issue resides in the grant copy operation, which manages data transfers between virtual machines. Because the system incorrectly reuses memory permission checks, a malicious guest can bypass isolation to access unauthorized memory, including that of the dom0 management domain. The Xen Project, which released patches on November 3, credited the discovery to the artificial intelligence company Anthropic, with validation from Ada Logics and the CodeAnt AI Security Research Team. Platforms built on Xen, such as XCP-ng and Qubes OS, have confirmed that a single compromised guest could potentially take over an entire host. While patches are available for supported versions, older releases that have reached the end of their security support remain vulnerable. Administrators are urged to apply the updates and perform necessary system restarts to mitigate the risk, as no other workarounds are currently available to prevent potential exploitation of these critical flaws.
Source: The Hacker News
