Arm: multiple issues with GNTTABOP_cache_flush

Description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702.

Scores

EPSS (exploitation in 30 days)

0.29% · top 78% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-191 Integer Underflow (Wrap or Wraparound) (opens in a new tab)All about CWE-191 and its CVEs

Affected products

• Xen · Xen

  • unknown consult Xen advisory XSA-519

What to do

Workaround: There is no known mitigation.

References (1)

• https://xenbits.xenproject.org/xsa/advisory-519.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-102702](https://trackcve.app/badge/CVE-2026-102702.svg)](https://trackcve.app/cve/CVE-2026-102702)

Record last updated 20 Oct 2026, 17:28 UTC.