CVE-2026-79603
Medium
Description
x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.
SeverityMedium
CVSS4.3
Exploit probability—
Product—
PublishedSep 8, 2026
First seenSep 8, 2026
Weakness typeCWE-664CWE-664
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
Sources have not yet published the affected products and versions for this vulnerability.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.