Xen: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437… (CVE-2026-102702)

CVE-2026-102702 is a vulnerability in the Xen hypervisor's grant table cache flush operation (GNTTABOP_cache_flush). The flaw allows the invalidate-without-clean operation to be used on read-only grant mappings, potentially corrupting the memory granted to other domains. This vulnerability is part of a broader set of issues addressed in XSA-437, which also includes CVE-2026-102699 related to calculation underflows causing hypervisor crashes on 64-bit ARM. The affected versions include multiple Ubuntu Xen package releases from 4.5.1 through 4.20.3 variants. The CVSS v3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network exploitable with low attack complexity, no privileges or user interaction required, no confidentiality or integrity impact, but high availability impact.

Exploitation of CVE-2026-102702 can lead to corruption of memory granted to other domains via the grant table interface. This can affect the stability and availability of the hypervisor and guest domains. The vulnerability does not impact confidentiality or integrity but can cause denial of service conditions due to memory corruption. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid using affected versions or restrict usage of the GNTTABOP_cache_flush operation on read-only grant mappings if possible.