The GNTTABOP_cache_flush operation can be used on memory that is mapped from another domain through the grant table interface. When the hypervisor does not prevent the use of the invalidate-without-clean flag on read‑only grant mappings, the operation may corrupt the memory on the target domain. This memory corruption can disrupt normal hypervisor operation, potentially causing instability or crashes, and it undermines the isolation guarantees between virtual machines. The vulnerability is a classic integer or bounds error that allows modification of memory that should be protected.

Xen hypervisor architectures running on 64‑bit Arm platforms that implement the GNTTABOP_cache_flush ABI. No specific version range is documented; the flaw is present in any Xen build that supports the affected operation on Arm.

The CVSS score of 7.5 indicates a medium‑high severity. The EPSS score of less than 1% signals a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a malicious or compromised guest domain that can control grant table entries and invoke the GNTTABOP_cache_flush operation. Because the flaw involves uncontrolled memory corruption, it can compromise integrity and availability of the hypervisor and the affected virtual machines. The risk is considerable, especially for environments that expose the grant table interface to multiple tenants.