Xen patches guest-to-host memory flaws that Anthropic found using Claude (XSA-523)

The Xen Project published security advisory XSA-523 on November 3, fixing two vulnerabilities in the open-source hypervisor that can break the isolation between virtual machines. According to the advisory, a malicious guest can read and write arbitrary memory belonging to other domains on the same host, including dom0, the privileged domain that manages the machine.

What the bugs are

Both flaws sit in grant copy, the mechanism Xen uses to copy data between domains through shared pages. To speed up batches of copies that touch neighbouring ranges in the same page, Xen reuses permission checks it has already performed. The advisory says the conditions for redoing those checks were wrong in two ways. Under CVE-2026-102703, frame numbers and grant references could be confused with each other. Under CVE-2026-102704, the check meant to restrict copies by frame number to the caller's own memory was in the wrong place.

All Xen versions from 4.6 onward are vulnerable; 4.5 and older are not. The Xen Project says no mitigation is known, so applying the patches is the only fix. Patches are published for xen-unstable and the 4.19 branch, and for 4.17 and 4.18. The Hacker News notes that no patch exists for 4.6 through 4.16, which are out of security support, and that the advisory does not report any exploitation in the wild.

Who found it

The advisory states that the issue "was discovered by Anthropic using Claude" and then validated by Stephan Lipp of Ada Logics. It adds that the CodeAnt AI Security Research Team later reported the same problem independently. The advisory does not describe how Claude was used in the research.

Downstream fixes

Projects built on Xen have issued their own updates. Qubes OS, whose security model relies on Xen isolation, says in bulletin QSB-121 that all its supported releases and configurations are affected. Users of Qubes 4.3 get fixed Xen packages (version 4.19.6-3) through the normal update tool and must restart dom0; those using Anti Evil Maid also need to reseal their passphrase because the new binaries change measured boot values. The packages are moving from the testing to the stable repository over roughly two weeks.

The Hacker News reports that Vates shipped a fix for XCP-ng 8.3 on November 3, rated Critical and requiring a host reboot, and that on November 4 Debian's security tracker still listed the xen package as vulnerable in bookworm, trixie and forky, with a fix only in sid. Administrators running multi-tenant or untrusted guests on Xen should check their vendor's channel for updated packages.