Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory

The Xen Project has disclosed two vulnerabilities, CVE-2026-102703 and CVE-2026-102704 (XSA-523), that allow a malicious guest virtual machine to read and write memory belonging to other VMs on the same host, including the privileged dom0 that normally manages the whole system. The bug lies in the grant copy mechanism Xen uses to move data between VMs: to speed up batched copies, Xen skips re-checking permissions it had already verified, but in certain cases it skips a check it should have performed, letting an attacker break guest isolation. Every Xen release from 4.6 onward is affected (versions 4.5 and earlier are safe), and Anthropic's Claude model is credited with first spotting the issue, later confirmed by Ada Logics and CodeAnt AI. Fixes are already available for Xen 4.17 through 4.19 and for XCP-ng 8.3 and Qubes OS 4.3, while Xen 4.6–4.16 remain unpatched and Debian still lists bookworm, trixie and forky as vulnerable, so admins running affected hypervisors should apply updates and reboot hosts as soon as possible.