Xen hypervisor caches grant copy validation data to boost performance. In some cases the re‑validation logic incorrectly mixes frame numbers and grant references, creating an improper access control weakness (CWE‑284). This fault allows a virtual machine to read or write memory pages that belong to another VM without authentication, leading to confidentiality compromise, data corruption, or even escalation to hypervisor control if fully exploited.

The vulnerability affects the Xen hypervisor. Any Xen deployment that performs grant copy operations between virtual machines is potentially impacted. No specific version information is provided, so all versions of Xen that support grant copies should be considered at risk until a patched release is applied.

The CVSS and EPSS scores are not available, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw permits arbitrary read/write between VMs, the potential impact is severe. The likely attack vector is local to a virtual machine that can issue grant copy requests; this inference is based on the description of the grant copy operation. Exploitation requires triggering a grant copy that mixes frame and grant identifiers, which would give the attacker unauthorized access to other VM memory. In the absence of a patch, this remains a high‑risk vulnerability until corrected.