CVE-2026-79609

XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.

• CWE-284

• https://xenbits.xenproject.org/xsa/advisory-516.html
• https://xenbits.xen.org/xsa/advisory-516.html

Published

Oct 13, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79592An out-of-bounds read vulnerability exists in the xls_dumpSu…7.5
• CVE-2026-7960Race in Speech in Google Chrome prior to 148.0.7778.96 allow…5.3
• CVE-2026-79602A guest with a PCI device assigned that has at least a BAR o…8.8
• CVE-2026-79603x86 PV guests can free memory pages while still keeping a st…4.3
• CVE-2026-79607During Xenstore live update the state record for a Xenstore …5.5
• CVE-2026-79608The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was la…9.8
• CVE-2026-7961Insufficient validation of untrusted input in Permissions in…4.3
• CVE-2026-79610XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes …8.8
• CVE-2026-79611For XSA-308 logic was introduced, as VMX VMEntry checks do n…5.5
• CVE-2026-79613vulnerability in Apache Answer. This issue affects Apache…5.3
• CVE-2026-79615The Quiz and Survey Master (QSM) WordPress plugin before 11…2.7
• CVE-2026-79616Out-of-bounds read while parsing untrusted SVG path strings …0.6