CVE-2026-79602: Xen Hypervisor Buffer Overflow Vulnerability

CVE-2026-79602 Overview

CVE-2026-79602 is a flaw in the Xen hypervisor that allows a guest domain with an assigned PCI device to trigger a BUG() condition. The guest must have a device with at least one Base Address Register (BAR) mapped to the IO port space. Reaching the BUG() macro forces the hypervisor into an unrecoverable state, affecting host availability and other guests running on the same physical machine.

Critical Impact
A local guest user with an assigned PCI device can crash the Xen hypervisor, causing host-wide denial of service and impacting confidentiality and integrity of co-resident guests due to scope change.

Affected Products

Xen hypervisor (see Xen Project Security Advisory 510 for affected versions)
Systems using PCI passthrough with devices exposing IO port BARs
Virtualization hosts running guests with assigned PCI devices

Discovery Timeline

2026-09-08 - CVE-2026-79602 published to NVD alongside Xen Project Security Advisory 510
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-79602

Vulnerability Analysis

The vulnerability affects Xen's handling of PCI devices passed through to guest domains. When a guest is assigned a PCI device that exposes at least one BAR in the processor's IO port address space, guest-controlled interactions can drive the hypervisor down a code path that terminates in a BUG() invocation. The BUG() macro in Xen is a defensive assertion that halts execution when an invariant is violated. Reaching this path from a guest converts an internal consistency check into a guest-triggerable host crash.

This is classified as [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating that boundary or validation logic around IO port BAR handling is insufficient. The scope change reflected in the CVSS vector indicates that impact extends beyond the guest to the hypervisor and, transitively, to all other guests on the host.

Root Cause

The root cause lies in Xen's emulation and validation logic for PCI device IO port BARs. Assumptions about the state or configuration of the BAR are not sufficiently guarded before reaching the assertion. Consult Xen Project Security Advisory 510 for the specific code paths and affected functions.

Attack Vector

An attacker requires code execution inside a guest domain that has been assigned a PCI device with an IO port BAR. From that position, the attacker interacts with the device or manipulates its configuration in a way that reaches the vulnerable code path in Xen. No user interaction is required, and privileges within the guest are limited. Successful triggering crashes the hypervisor, denying service to all guests on the affected host.

No public proof-of-concept exploit is currently referenced in the advisory. Technical specifics are documented in the OpenWall OSS Security discussion.

Detection Methods for CVE-2026-79602

Indicators of Compromise

Unexpected Xen hypervisor panics or host reboots correlated with guest activity on PCI-assigned devices
Serial console or xl dmesg output showing BUG() assertions in code paths related to PCI IO port BAR handling
Guests with assigned PCI devices exhibiting abnormal IO port configuration writes prior to host crashes

Detection Strategies

Audit host inventories for guests configured with PCI passthrough where the assigned device exposes IO port BARs (lspci -vv on the host)
Correlate hypervisor crash dumps with guest workload timelines to identify guest-triggered host failures
Enable Xen debug logging on non-production hosts to capture the stack trace leading to BUG()

Monitoring Recommendations

Monitor xl dmesg, /var/log/xen/, and hypervisor console output for assertion failures and unexpected reboots
Track uptime and availability metrics on virtualization hosts to identify recurring denial-of-service patterns
Alert on any new PCI passthrough configurations added to guest domain definitions until hosts are patched

How to Mitigate CVE-2026-79602

Immediate Actions Required

Apply the Xen patches referenced in Xen Project Security Advisory 510 as soon as they are available for your distribution
Inventory all guests with PCI passthrough and identify those with devices exposing IO port BARs
Restrict administrative access to guests with assigned PCI devices until patches are deployed

Patch Information

Refer to Xen Project Security Advisory 510 for the authoritative list of affected Xen versions and corresponding patches. Distribution vendors typically release backported updates shortly after publication. Reboot or perform live-migration-based updates on hypervisors according to your operational procedures.

Workarounds

Avoid assigning PCI devices that expose BARs in the IO port space to untrusted guests until patches are applied
Where feasible, migrate to PCI devices that use only Memory-Mapped IO (MMIO) BARs for passthrough scenarios
Isolate hosts running PCI passthrough workloads from multi-tenant environments to limit blast radius

bash

# Identify PCI devices with IO port BARs on the host
lspci -vv | grep -E "^[0-9a-f]{2}:|I/O ports"

# Review guest configurations for PCI passthrough assignments
grep -E "pci\s*=" /etc/xen/*.cfg