{"id":"ALPINE-CVE-2026-79603","details":"x86 PV guests can free memory pages while still keeping a stale TLB entry\npointing to them.  A TLB flush is only issued by Xen (if needed) when the\npage is re-used.  Since it's possible for the page to be scrubbed ahead of\nthe TLB flush, there's a window where a PV guest can modify an already\nscrubbed page.","modified":"2026-09-25T15:30:02.607298919Z","published":"2026-09-08T13:17:27.253Z","upstream":["CVE-2026-79603"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2026-79603"}],"affected":[{"package":{"name":"xen","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/xen?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.6-r1"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2026-79603.json"}},{"package":{"name":"xen","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/xen?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4-r1"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2026-79603.json"}},{"package":{"name":"xen","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/xen?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.4-r1"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2026-79603.json"}},{"package":{"name":"xen","ecosystem":"Alpine:v3.24","purl":"pkg:apk/alpine/xen?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.2-r1"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2026-79603.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}