Vulnerability intelligence
CVE-2026-102700 and is rated Medium severity with a CVSS score of 4.7. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.
We have pushed updates to both the Early Access and Normal update channels of each of XenServer 8.4 and XenServer 9. We recommend that customers update to the latest version from their chosen channel following the instructions at https://docs.xenserver.com/en-us/xenserver/8/update or https://docs.xenserver.com/en-us/xenserver/9/update
With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path.
That error path fails to drop a page reference in case the specified page is owned by a special system domain (DOM_IO and DOM_COW are system domains which can have memory pages assigned to them.)
Source: NVD