CVE-2026-102702 Arm: multiple issues with GNTTABOP_cache_flush
A guest can corrupt read-only granted memory or crash the hypervisor via GNTTABOP_cache_flush due to missing restrictions and integer underflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102702?
CVE-2026-102702 is a high-severity vulnerability in Xen, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor.
This is CVE-2026-102699.
2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory.
This is CVE-2026-102702.
Weakness: CWE-191
Which versions are affected by CVE-2026-102702?
How do I fix CVE-2026-102702?
Apply the vendor's patch.
Is CVE-2026-102702 being exploited?
There is no known exploitation of CVE-2026-102702 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-102702, GHSA-p4h6-6vf5-jwcw, UBUNTU-CVE-2026-102702.