PatchTheCVECVE-2026-23554: The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is
CVE-2026-23554 is a high-severity flaw (CVSS 7.8) affecting xen. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Weakness | CWE-367 |
| Published | 2026-03-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-23554?
xen: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2026-23554 being exploited?
CVE-2026-23554 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-23554 affect?
CVE-2026-23554 affects xen. Severity is high (CVSS 7.8). The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structure
How urgent is CVE-2026-23554?
Priority 28/100. High severity
Software pages
Intel vulnerabilities · Xen vulnerabilities
Related CVEs
- CVE-2026-23558 HIGH 7.8 MITIGATE The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when
- CVE-2026-23557 MEDIUM 6.5 MITIGATE Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an as
- CVE-2026-23555 HIGH 7.1 MITIGATE Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will cra