The short version
● CVEs — CVE-2026-102703 and CVE-2026-102704 (XSA-523)
● Impact — one guest VM reads and writes any other, including dom0
● Found by — Anthropic, using Claude
● Fix — patch; there is no known mitigation
Xen security advisory XSA-523 covers CVE-2026-102703 and CVE-2026-102704, two flaws in the grant copy operation that let a malicious guest VM read and write the memory of other VMs on the same host, including dom0. Xen reuses permission checks for batched copies within a memory page and in some cases failed to recheck when it should have. Vates rates the impact for XCP-ng as critical.
The Xen Project credited Anthropic with finding the flaws using Claude. Stephan Lipp of Ada Logics validated the finding, and the CodeAnt AI Security Research Team independently reported the same issue. Xen 4.6 and later are affected; 4.5 and earlier are not. Patches exist for xen-unstable through 4.19.x and for 4.18.x and 4.17.x, but there is no patch for 4.6 through 4.16, and 4.16 left security support in December 2024.
Downstream, XCP-ng 8.3 shipped xen-4.17.7-4.2.xcpng8.3 on 3 November and Qubes OS 4.3 has Xen 4.19.6-3 in dom0, both requiring a reboot. As of 4 November, Debian listed bookworm, trixie and forky as vulnerable with sid fixed. There is no known mitigation, so patching is the only fix, and the Xen advisory does not mention any attacks exploiting the flaws.
More from 5 November
Full dated index: every AI release in November 2026.
Sources