A Xen Flaw Found by Anthropic's Claude Lets One Guest VM Read and Write Any Other VM's Memory, Dom0 Included. Every Version Since 4.6 Is Affected, and There Is No Mitigation.
If you run Xen, XCP-ng or Qubes OS, patch and reboot the host. Xen security advisory XSA-523, dated November 3, covers two flaws (CVE-2026-102703 and CVE-2026-102704) that let a malicious guest read and write arbitrary memory belonging to other domains, including Dom0. The advisory says there is no known mitigation. Every Xen version from 4.6 onward is vulnerable.
What the flaws are
Both bugs are in grant copy, the mechanism Xen uses to let one domain copy memory to or from another through permissions the owner has granted. To speed up batches of copies on adjacent address ranges, Xen reuses data it already checked. The advisory says the conditions for re-validating that cached data were wrong in some cases.
CVE-2026-102703 is a mix-up between frame numbers and grant references. CVE-2026-102704 is a misplaced check on copying by frame number, which should be allowed only for the caller's own memory. The advisory's impact line is plain: a malicious guest can read and write arbitrary memory belonging to other domains, including Dom0. In a hypervisor that is the whole host. XCP-ng's notice, as quoted by The Hacker News, says a single compromised guest can break out of its isolation and take over the host.
Who is affected and what to do
All Xen versions from 4.6 onward. Versions 4.5 and earlier are not vulnerable. The advisory does not say which architectures or guest types are affected, and it gives no severity score, though Vates rates the impact on XCP-ng as Critical.
Patches exist for xen-unstable and Xen 4.19.x, and a second set for Xen 4.18.x through 4.17.x. For Xen 4.6 through 4.16 the advisory ships no patch, and the Xen project's security support for 4.16 ended in December 2024. If you are on one of those, the honest answer is that you need to move to a supported release.
The vendors that have shipped, per The Hacker News: XCP-ng 8.3 has xen-4.17.7-4.2.xcpng8.3, released November 3; Qubes OS 4.3 has Xen 4.19.6-3 for Dom0; and Debian showed bookworm, trixie and forky as still vulnerable on November 4, with only sid fixed. A host needs a reboot after patching. Qubes users who use Anti Evil Maid must reseal their passphrase, because PCR18 and PCR19 change.
The threat model is a hostile or compromised guest on a host shared with others. If every guest on your hosts is yours and trusted, the risk is lower but not zero, because a compromised guest becomes a host compromise. If you rent guests to customers, this is the urgent case.
The finder
The advisory credits the discovery to Anthropic using Claude, validated by Stephan Lipp of Ada Logics, and says the CodeAnt AI Security Research Team independently reported the same issue. We note this as a fact from the advisory and not as a claim about anything else. Our partnership with Claude is no secret, so read our take on it as that of an interested party. The advisory is the source for who found what.
An earlier grant copy flaw, XSA-500, was disclosed on July 28, so this is the second in the same area in about three months.
What we know and what we do not
Neither source reports exploitation, and neither mentions a CISA listing. There are no indicators to hunt for: this is a host-level privilege boundary bug, and there is no published exploit code or network signature. Nothing goes in the feed from this one.
Limits
We read the Xen advisory directly. The vendor patch details (XCP-ng, Qubes, Debian) come from The Hacker News and we did not open the vendor pages. We did not test any patch, and the advisory does not name the architectures it covers.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.