The Xen Project has credited Anthropic's Claude with discovering two hypervisor flaws that let a malicious guest virtual machine read and write the memory of other domains on the same host, including the privileged Dom0. The bugs, tracked as CVE-2026-102703 and CVE-2026-102704, are covered in Xen Security Advisory XSA-523, published November 3.
The advisory's credits say the issue "was discovered by Anthropic using Claude, then validated by Stephan Lipp of Ada Logics." The CodeAnt AI Security Research Team later reported the same issue independently. All Xen versions from 4.6 onward are vulnerable, while 4.5 and earlier are not, and the Xen Project says there is no known mitigation beyond patching.
Both bugs sit in Xen's grant copy path, which guests use to copy data between memory pages. A common pattern is a batch of grant copy operations on adjacent address ranges in the same page, so Xen caches already-validated details to avoid repeating checks. According to the advisory, the conditions for when to re-validate that cached data were wrong in some cases.
Key facts
- 01Xen advisory XSA-523, published November 3, 2026, says the flaws were discovered by Anthropic using Claude.
- 02CVE-2026-102703 and CVE-2026-102704 let a malicious guest read and write memory of other domains, including Dom0.
- 03All Xen versions from 4.6 onward are vulnerable; the advisory says there is no known mitigation.
- 04Patches cover xen-unstable through 4.19.x and 4.18.x to 4.17.x; Qubes 4.3 is fixed in Xen 4.19.6-3.
- 05Ada Logics' Stephan Lipp validated the finding; CodeAnt AI later reported the same issue independently.
In CVE-2026-102703, frame numbers and grant references could be mixed up. In CVE-2026-102704, the check that limits copying by frame number to the caller's own memory was misplaced. The combined impact, in the advisory's words: "A malicious guest can read and write arbitrary memory, belonging to other domains, including Dom0."
Xen published patches for xen-unstable through Xen 4.19.x, and a separate set for Xen 4.18.x through 4.17.x. The advisory warns that the patches for released versions may not apply cleanly to the most recent release tarball and encourages downstream projects to update to the tip of the stable branch. Older branches from 4.6 through 4.16 receive no patch in the advisory; security support for Xen 4.16 ended on December 2, 2024.
Downstream distributions moved the same day. XCP-ng 8.3 shipped a fix in xen-4.17.7-4.2.xcpng8.3 on November 3, and hosts must be rebooted to apply it. Vates, the company behind XCP-ng, rates the impact as critical, and the XCP-ng update notes say a single compromised guest can break out of its isolation and take over the whole host.
Qubes OS, which uses Xen to isolate workloads into separate qubes, published bulletin QSB-121 the same day and said all supported Qubes releases and configurations are affected. Qubes 4.3 is fixed in dom0 Xen packages version 4.19.6-3, which move from the security-testing repository to the stable repository over the next two weeks. Dom0 must be restarted, and Anti Evil Maid users need to reseal their secret passphrase because the new Xen binaries change PCR18 and PCR19.
As of November 4, Debian's security tracker listed the xen package in bookworm, trixie and forky as vulnerable, with sid fixed. The advisory does not describe any attacks exploiting the flaws or what level of access inside a guest an attacker would need.
XSA-523 is separate from XSA-500, an earlier grant copy flaw the Xen Project disclosed on July 28.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
