Citrix Xen Virtualization Software

By the Year

In 2026 there have been 47 vulnerabilities in Citrix Xen with an average score of 6.9 out of ten. Last year, in 2025 Citrix Xen had 9 security vulnerabilities published. That is, 38 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.98

Recent Citrix Xen Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-79611	Oct 13, 2026	Xen Hypervisor VMX VMEntry Failure (CVE-2026-79611) For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest. Sadly there is another special sub-case of the above, with branch tracing enabled. In that case the prior adjustment would still cause a VMentry failure, as before fatal to the guest.	Xen
CVE-2026-79610	Oct 13, 2026	Xen Hypervisor Grant Table Race Condition Causing Stale Pointers (XSA-501) XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.	Xen
CVE-2026-79609	Oct 13, 2026	Xen Hypervisor XPTI Page Table Isolation Flaw CVE-2026-79609 XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.	Xen
CVE-2026-79608	Oct 13, 2026	Xen Hypervisor - MSR Inverted Conditional Workaround Rework Failure The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa. For more details, see: http://xenbits.xen.org/xsa/advisory-433.html	Xen
CVE-2026-79607	Oct 13, 2026	Xenstore Watch State Record Byte Omission Crash During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data.	Xen
CVE-2026-79603	Sep 08, 2026	Xen Hypervisor TLB Flush Race Exposes PV Guest Memory Modification x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.	Xen
CVE-2026-79602	Sep 08, 2026	Xen Hypervisor PCI BAR I/O Port BUG Trigger Vulnerability A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.	Xen
CVE-2026-62437	Sep 08, 2026	Xen Hypervisor Guest Termination IRQ Tracking Race When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be.	Xen
CVE-2026-62434	Jul 28, 2026	Xen PoD Guest Reclaimer Causes Memory Management Corruption A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.	Xen
CVE-2026-62433	Jul 28, 2026	Xen Hypervisor Unchecked Buffer Count in DM_OP leads to stack corruption Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.	Xen