CVE-2026-79609 x86: XPTI may break on huge-memory systems
Xen hypervisor fails to apply Meltdown mitigation on systems with memory above 5 TiB, allowing potential information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79609?
CVE-2026-79609 is a high-severity vulnerability in Xen, published on 13 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.
Weakness: CWE-284
Which versions are affected by CVE-2026-79609?
How do I fix CVE-2026-79609?
Apply the vendor's patch.
Is CVE-2026-79609 being exploited?
There is no known exploitation of CVE-2026-79609 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-79609, DEBIAN-CVE-2026-79609, GHSA-842c-7fjj-j8jj, UBUNTU-CVE-2026-79609.