The Xen hypervisor vulnerability (CVE-2026-79603) affects x86 paravirtualized guests on Xen versions 4.13 and later. The flaw arises because a TLB flush is only issued when a freed page is reused, not immediately upon freeing. This delay allows a PV guest to modify a memory page after it has been scrubbed but before the TLB flush occurs, bypassing the isolation intended by the 'xsm=silo scrub-domheap' configuration. Xen versions 4.12 and earlier are not vulnerable as they lack this scrub-domheap feature. The vulnerability specifically impacts memory management and isolation between guests in PV mode on x86 architectures.

The vulnerability allows an x86 PV guest to modify memory pages that should have been scrubbed and isolated, potentially leading to information leakage between guests. This breaks the intended security isolation provided by the 'scrub-domheap' feature. There is no indication of privilege escalation, denial of service, or integrity impact beyond the described memory modification window. The CVSS vector indicates network attack vector with low attack complexity and low privileges required, but only limited confidentiality impact and no integrity or availability impact.

No official patch or fix is indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, deployments relying on 'xsm=silo scrub-domheap' should be aware that this configuration does not effectively prevent information exchange among x86 PV guests. Consider disabling PV guests or avoiding the use of 'scrub-domheap' in environments where strict guest isolation is required.