Vulnerability · Published Oct 13, 2026 · Assigned by XEN
CVE-2026-79609x86: XPTI may break on huge-memory systems
High 8.8
In plain English
A high-severity improper access control in Xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | xen | 4.19.6-r2 | ALPINE-CVE-2026-79609 |
| Alpine:v3.22 | xen | 4.20.4-r2 | ALPINE-CVE-2026-79609 |
| Alpine:v3.23 | xen | 4.20.4-r2 | ALPINE-CVE-2026-79609 |
| Alpine:v3.24 | xen | 4.21.2-r2 | ALPINE-CVE-2026-79609 |
| Debian:12 | xen | 4.17.7+13-g2445b30a44-0+deb12u1 | DEBIAN-CVE-2026-79609 |
| Debian:13 | xen | 4.20.4+39-gf1e1321c87-0+deb13u1 | DEBIAN-CVE-2026-79609 |
| Debian:14 | xen | 4.20.4+39-gf1e1321c87-1 | DEBIAN-CVE-2026-79609 |
| Ubuntu:22.04:LTS | xen | no fix listed | UBUNTU-CVE-2026-79609 |
| Ubuntu:24.04:LTS | xen | no fix listed | UBUNTU-CVE-2026-79609 |
| Ubuntu:26.04:LTS | xen | no fix listed | UBUNTU-CVE-2026-79609 |
| Ubuntu:26.10 | xen | no fix listed | UBUNTU-CVE-2026-79609 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H