CVE-2026-79610

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.

• CWE-362

• https://xenbits.xenproject.org/xsa/advisory-517.html
• https://www.openwall.com/lists/oss-security/2026/10/13/6
• https://xenbits.xen.org/xsa/advisory-517.html

Published

Oct 13, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79602A guest with a PCI device assigned that has at least a BAR o…8.8
• CVE-2026-79603x86 PV guests can free memory pages while still keeping a st…4.3
• CVE-2026-79607During Xenstore live update the state record for a Xenstore …5.5
• CVE-2026-79608The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was la…9.8
• CVE-2026-79609XPTI (Xen Page Table Isolation) was introduced to mitigate M…8.8
• CVE-2026-7961Insufficient validation of untrusted input in Permissions in…4.3
• CVE-2026-79611For XSA-308 logic was introduced, as VMX VMEntry checks do n…5.5
• CVE-2026-79613vulnerability in Apache Answer. This issue affects Apache…5.3
• CVE-2026-79615The Quiz and Survey Master (QSM) WordPress plugin before 11…2.7
• CVE-2026-79616Out-of-bounds read while parsing untrusted SVG path strings …0.6
• CVE-2026-79617Incorrect Permission Assignment for Critical Resource vulner…7.1
• CVE-2026-79618The WP User Frontend WordPress plugin before 4.3.12 does not…4.3