CVE-2026-23553

In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1) vCPU runs on CPU A, running task 1. 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB. 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB. 4) vCPU moves back to CPU A. Xen skips IBPB again. Now, task 2 is running on CPU A with task 1's training still in the BTB.

• CWE-665
• CWE-693

• https://xenbits.xenproject.org/xsa/advisory-479.htmlMitigation, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/01/27/3Mailing List, Mitigation, Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-479.htmlMitigation, Patch, Vendor Advisory

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23547Missing Authorization vulnerability in cmsmasters CMSMasters…7.1
• CVE-2026-23548Missing Authorization vulnerability in Designinvento Directo…5.3
• CVE-2026-23549Deserialization of Untrusted Data vulnerability in magepeopl…9.8
• CVE-2026-2355The My Calendar – Accessible Event Manager plugin for WordPr…6.4
• CVE-2026-23550Incorrect Privilege Assignment vulnerability in Modular DS M…9.8
• CVE-2026-23552Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolic…9.1
• CVE-2026-23554The Intel EPT paging code uses an optimization to defer flus…7.8
• CVE-2026-23555Any guest issuing a Xenstore command accessing a node using …7.1
• CVE-2026-23556When oxenstored is tearing a domain down, the node data is c…9.4
• CVE-2026-23557Any guest can cause xenstored to crash by issuing a XS_RESET…6.5
• CVE-2026-23558The adjustments made for XSA-379 as well as those subsequent…7.8
• CVE-2026-23559[This CNA information record relates to multiple CVEs; the t…9.4