CVE-2026-62435: Xen Grant Table Race Condition Vulnerability

CVE-2026-62435 Overview

CVE-2026-62435 is a race condition [CWE-362] in the Xen hypervisor's grant table implementation. The flaw affects the code path that switches grant table version 1 (v1) to version 2 (v2). Switching from v1 to v2 reduces the number of valid grant references because the shared entry structure grows while the shared table itself does not change size. Code that drops and re-acquires the grant table lock incorrectly assumes these size properties remain stable across the unlocked window.

Critical Impact
A malicious guest can trigger inconsistent grant table state, resulting in information disclosure and potential denial of service against the hypervisor host.

Affected Products

Xen Project hypervisor with Grant Table v2 support
Systems that permit guest-initiated grant table version switching
Virtualization hosts running affected Xen releases (see Xen Project advisory XSA-501)

Discovery Timeline

2026-07-28 - CVE-2026-62435 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-62435

Vulnerability Analysis

The Xen grant table subsystem allows guests to share memory pages with other guests or the hypervisor. Grant Table v2 introduced a richer shared entry structure and separate status frames. Because v2 entries are larger than v1 entries, the number of grants that fit in the fixed-size shared table drops when switching v1 to v2.

The vulnerable code holds the grant table lock, then intermediately drops and re-acquires it. During that unlocked window, another CPU can complete a version switch. When the original code path resumes, it operates on stale assumptions about the number of valid grant references. This can lead to out-of-bounds access or inconsistent lookups against grant metadata.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) flaw in grant table lock management. The affected functions cache invariants derived from the current grant table version, release the lock for a subordinate operation, and then reuse those cached invariants without re-validating them. Xen Security Advisory 501 documents that the v1 to v2 path corresponds to CVE-2026-62435 while the v2 to v1 path is tracked as CVE-2026-62436.

Attack Vector

A guest with permission to manage its own grant table can invoke the GNTTABOP_set_version hypercall concurrently with other grant table operations. By racing version switches against grant reference lookups, the guest forces the hypervisor to reference grant slots that no longer exist under the new version layout. Refer to the Xen Project Security Advisory 501 for the authoritative technical description.

Detection Methods for CVE-2026-62435

Indicators of Compromise

Unexpected Xen hypervisor log entries referencing grant table version transitions or grant reference errors
Guest VMs issuing repeated GNTTABOP_set_version hypercalls in rapid succession
Hypervisor crashes or BUG_ON traces originating in common/grant_table.c

Detection Strategies

Audit hypervisor logs (xl dmesg) for anomalous grant table warnings or assertion failures
Monitor guest hypercall frequency for outliers in grant table version-switch operations
Correlate guest-triggered hypervisor faults with grant table subsystem stack traces

Monitoring Recommendations

Forward Xen hypervisor logs to a centralized logging pipeline for longitudinal analysis
Baseline normal grant table operation counts per guest and alert on statistical deviation
Track host uptime and unexpected reboots that may indicate hypervisor-level denial of service

How to Mitigate CVE-2026-62435

Immediate Actions Required

Apply the patches referenced in Xen Security Advisory XSA-501 as soon as they are available for your distribution
Inventory hypervisor hosts running Xen and confirm grant table v2 support is enabled before assessing exposure
Restrict untrusted guest workloads on hosts that cannot be patched immediately

Patch Information

Xen Project has published fixes through Xen Security Advisory 501. Consult the Xen Project Security Advisory 501 for the patch series, affected version ranges, and vendor-specific backports from downstream distributions such as Debian, SUSE, and Citrix Hypervisor.

Workarounds

Configure guests to use grant table v1 exclusively where operationally feasible
Limit which guests are trusted to run on shared hosts until patches are deployed
Isolate multi-tenant workloads on separate physical hosts to reduce cross-guest race exposure

bash

# Verify Xen version and grant table configuration on the host
xl info | grep -E "xen_version|xen_commandline"

# Review hypervisor log for grant table anomalies
xl dmesg | grep -i "grant"