CVE-2026-102699 Arm: multiple issues with GNTTABOP_cache_flush
A guest can trigger an underflow in cache flush calculations, causing a long-running loop that crashes the Xen hypervisor on 64-bit Arm systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102699?
CVE-2026-102699 is a high-severity denial of service vulnerability in Xen, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor.
This is CVE-2026-102699.
2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory.
This is CVE-2026-102702.
Weakness: CWE-191
Which versions are affected by CVE-2026-102699?
How do I fix CVE-2026-102699?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-102699 being exploited?
There is no known exploitation of CVE-2026-102699 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-102699, DEBIAN-CVE-2026-102699, GHSA-hghw-wh6h-2jx6, UBUNTU-CVE-2026-102699.