Skip to content
AI Security Wire

Published

- 4 min read

By

Xen XSA-523: Claude-Found Grant Copy Bugs Let a Guest Read Dom0 Memory

Xen XSA-523 CVE-2026-102703 CVE-2026-102704 AI vulnerability discovery hypervisor Claude
img of Xen XSA-523: Claude-Found Grant Copy Bugs Let a Guest Read Dom0 Memory

Two new Xen hypervisor flaws let a malicious guest read and write memory that belongs to other virtual machines, Dom0 included. The Xen Project published advisory XSA-523 on 3 November 2026, and it credits Anthropic’s Claude model with finding the bugs.

That last part is the news hook. The bugs themselves are a classic: the advisory says Xen reused cached validation data without re-validating it in the right conditions.

What the bugs are

Xen’s grant copy hypercall lets one domain copy data to or from another using grant references. Guests often submit batches of copy operations on adjacent address ranges within the same page. For speed, Xen caches details from earlier validation and reuses them. The advisory says the conditions for re-validating that cached data were wrong in some cases.

That produced two CVEs:

  • CVE-2026-102703: frame numbers and grant references could be mixed up.
  • CVE-2026-102704: copying by frame number is only allowed on the caller’s own memory, and the check enforcing that rule was in the wrong place.

The advisory’s impact statement is blunt: a malicious guest can read and write memory belonging to other domains, including Dom0. We have not reproduced this, and no public exploit has come to our attention.

Who is affected

All Xen versions from 4.6 onward, according to the advisory. Xen 4.5 and earlier are not vulnerable. Patches exist for xen-unstable, 4.19.x, 4.18.x and 4.17.x. The 4.17 and 4.18 branches share a patch set, and the advisory notes those patches may not apply cleanly to the latest release tarball, so downstream maintainers should move to the branch tip first.

Vates has issued VSA-2026-055 for XCP-ng 8.3. It classifies the impact as Critical “for Vates products”, lists CVSS 4.0 as not available yet, and names the fixed package as xen-4.17.7-4.2.xcpng8.3 (updated as of 3 November). The Xen patch list stops at 4.19.x; the advisory does not name later branches.

Severity: the sources disagree

Do not rely on one number. The Xen advisory gives no rating. Vates classifies the impact as Critical for its own products. NVD has not scored either CVE itself and its records were still at “Received” status on 5 November. They show only a secondary CVSS 3.1 score of 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) from source ID 134c704f, which appears to be CISA-ADP (our inference, from the same ID on the SSVC record). The Xen CNA gave no score. A local vector fits a guest-to-host attack, but the score does not capture a hypervisor guest escape well, because it scores a limited confidentiality and integrity impact with unchanged scope.

Our assessment: for any host that runs guests belonging to different customers or trust levels, treat this as critical regardless of the interim score. For a single-tenant lab where every guest is yours, the urgency is lower but patching is still required, since there is no mitigation.

Exploitation status

No evidence found as of 5 November 2026 in the CISA Known Exploited Vulnerabilities feed (version 2026.11.04), the Xen advisory or NVD that either CVE is exploited. FIRST’s EPSS API had no score published for either CVE on that date. CISA’s SSVC entry in NVD (4 November) reads exploitation: none, automatable: no, technical impact: partial.

AI-found bugs keep arriving

Our earlier coverage includes GhostLock, an AI-discovered Linux kernel root bug, and Squidbleed, a long-lived memory leak in the Squid proxy. XSA-523 adds a hypervisor to the list of widely deployed infrastructure code with AI-credited findings.

The advisory also credits an independent report from the CodeAnt AI Security Research Team. It gives no dates and does not say how that team found the issue, so we cannot say how close the two discoveries were. Our speculation, not a finding: if model-assisted review keeps surfacing bugs in mature code, patch windows for infrastructure projects may get tighter.

What to do

  1. Inventory Xen hosts and XCP-ng 8.3 pools, and identify those running untrusted or multi-tenant guests first.
  2. Apply the vendor patch or updated packages. If you build from source, use the branch tip as the advisory instructs.
  3. Plan reboots or live migration, since a hypervisor patch generally needs a host restart (our general guidance, not stated in the advisory).
  4. Subscribe to the Xen security announce list so the next XSA does not arrive by news article.

References

Frequently Asked Questions

Which Xen versions are affected by XSA-523?
The Xen Project advisory says all Xen versions from 4.6 onward are affected, and that 4.5 and earlier are not. Patches are published for xen-unstable, 4.19.x, 4.18.x and 4.17.x. The advisory warns that stable-branch patches may not apply cleanly to the latest release tarballs, so downstream projects should update to the branch tip first.
Is there a workaround for CVE-2026-102703 and CVE-2026-102704?
The advisory states there is no known mitigation. Patching the hypervisor is the only fix. Because the attacker is a malicious guest, the practical exposure depends on whether you run guests you do not fully trust.
How severe are these Xen bugs?
Sources disagree. The Xen advisory gives no severity rating. Vates rates its XCP-ng advisory VSA-2026-055 as Critical. NVD's record, which was still at Received status on 5 November, carries a secondary CVSS 3.1 score of 4.4 for each CVE (local vector, low privileges). Treat them as high priority for multi-tenant hosts.
Were the Xen bugs found by AI?
Per the Xen advisory, the issues were discovered by Anthropic using Claude and validated by Stephan Lipp of Ada Logics. The CodeAnt AI Security Research Team also reported them independently. That credit comes from the advisory alone, and we have not seen Anthropic's own account of the work.