DEBIAN-CVE-2026-102702

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-102702
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102702.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-102702
Upstream
  • CVE-2026-102702
Published
2026-10-13T16:17:09Z
Modified
2026-10-14T06:00:08Z
Summary
[none]
Details

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702.

References

Affected packages

Debian:12 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.17.1+2-gb773c48e36-1
4.17.2-1
4.17.2+55-g0b56bed864-1
4.17.2+76-ge1f9cb16e2-1~deb12u1
4.17.2+76-ge1f9cb16e2-1
4.17.3+10-g091466ba55-1~deb12u1
4.17.3+10-g091466ba55-1
4.17.3+10-g091466ba55-1.1~exp1
4.17.3+10-g091466ba55-1.1~exp2
4.17.3+10-g091466ba55-1.1
4.17.3+36-g54dacb5c02-1
4.17.5+23-ga4e5191dc0-1
4.17.5+23-ga4e5191dc0-1+deb12u1
4.17.5+72-g01140da4e8-1
4.17.7-0+deb12u1
4.19.0+14-g0918434e0f-1~exp1
4.19.1-1~exp1
4.19.1-1~exp4
4.19.1-1
4.20.0~rc2+1-gfcde5e0de8-1~exp1
4.20.0-1
4.20.0+68-g35cb38b222-1
4.20.2+7-g1badcf5035-1
4.20.2+7-g1badcf5035-2
4.20.2+37-g61ff35323e-1
4.20.3+127-gc42374a105-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102702.json"

Debian:13 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.20.0+68-g35cb38b222-1
4.20.2+7-g1badcf5035-0+deb13u1
4.20.2+7-g1badcf5035-1
4.20.2+7-g1badcf5035-2
4.20.2+37-g61ff35323e-0+deb13u1
4.20.2+37-g61ff35323e-1
4.20.3+127-gc42374a105-0+deb13u1
4.20.3+127-gc42374a105-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102702.json"

Debian:14 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.20.0+68-g35cb38b222-1
4.20.2+7-g1badcf5035-1
4.20.2+7-g1badcf5035-2
4.20.2+37-g61ff35323e-1
4.20.3+127-gc42374a105-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102702.json"