A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen. (CVE-2026-79602)

This vulnerability occurs in Xen hypervisor when a guest virtual machine is assigned a PCI device that includes at least one BAR mapped to IO port space. Under these conditions, the guest can trigger a BUG() in Xen, which is a kernel-level assertion failure leading to a crash or other critical failure. The CVSS 3.1 score is 8.8, indicating a high severity with local attack vector, low complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. The affected versions are specific Ubuntu Xen package releases ranging from 4.5.1-0ubuntu1 through 4.20.2+7-g1badcf5035-2 and others as listed.

Exploitation of this vulnerability can cause a critical failure in the Xen hypervisor, potentially leading to denial of service or compromise of the hypervisor's security guarantees. The impact includes loss of confidentiality, integrity, and availability of the system. The vulnerability requires local access with low privileges and no user interaction, but the scope of impact extends beyond the vulnerable component.

No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and avoid assigning PCI devices with IO port BARs to untrusted guests.