Description
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.

Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.

The v1 -> v2 issue is CVE-2026-62435.

The v2 -> v1 issue is CVE-2026-62436.
Published: 2026-07-28
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a race condition (CWE-362) in the Xen hypervisor grant table code that occurs when switching between grant table version 1 and version 2. The bug arises when the lock protecting the grant table is released and the code assumes table properties remain unchanged while the lock is not held. This flaw can lead to an inconsistent internal state, potentially resulting in memory corruption or a denial of service if an attacker can influence the version transition.

Affected Systems

Xen hypervisor systems that implement Grant Table V2 are affected. The issue was identified as CVE-2026-62435 within the Xen project. No specific vendor or product version ranges are listed, so all Xen hypervisor releases that support the grant table upgrade path are considered vulnerable.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of <1% shows a very low expected exploitation probability and it is not listed in the CISA KEV catalog. The vulnerability is likely exploitable by a privileged guest or an attacker with hypervisor control that can trigger a grant table version switch, but no public exploits are known. The overall risk is moderate but the low EPSS and absence from KEV reduce the likelihood of widespread exploitation.

Generated by OpenCVE AI on August 4, 2026 at 12:57 UTC.

Remediation

Vendor Workaround

Using the "gnttab=max-ver:1" hypervisor command line option will avoid the vulnerability. Using the "max_grant_version=1" guest configuration option for guests will also avoid the vulnerability.

OpenCVE Recommended Actions

  • Enable the hypervisor command line option "gnttab=max-ver:1" to lock the grant table to version 1 and avoid the race condition.
  • Configure guests with the "max_grant_version=1" setting to prevent grant table version upgrades during guest operation.
  • Update to the latest Xen hypervisor release that contains a patch for the race condition, or refer to the Xen project for the definitive fix.

Generated by OpenCVE AI on August 4, 2026 at 12:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6424-1 xen security update
History

Tue, 28 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Xen
Xen xen
Vendors & Products Xen
Xen xen

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, as a bigger shared entry structure is then needed while the shared table doesn't change size. Switching from v2 back to v1 the status frames, which are separate in v2, go away. Code holding, but intermediately dropping and then re-acquiring the grant table lock, sometimes wrongly assumes that said properties wouldn't change across the window in time where the lock is not being held. The v1 -> v2 issue is CVE-2026-62435. The v2 -> v1 issue is CVE-2026-62436.
Title grant-table: version change racing with other operations
Weaknesses CWE-362
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Xen Xen
cve-icon MITRE

Status: PUBLISHED

Assigner: XEN

Published:

Updated: 2026-07-28T15:19:30.368Z

Reserved: 2026-07-14T10:28:12.655Z

Link: CVE-2026-62435

cve-icon Vulnrichment

Updated: 2026-07-28T15:19:18.244Z

cve-icon NVD

Status : Deferred

Published: 2026-07-28T13:19:02.433

Modified: 2026-07-28T16:19:40.740

Link: CVE-2026-62435

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T13:00:11Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')