Two critical bugs in the Xen hypervisor's grant copy mechanism can expose other guests, and the privileged dom0 host, on the same server.
The Hacker News reports two Xen hypervisor flaws, tracked as CVE-2026-102703 and CVE-2026-102704 under advisory XSA-523, that let a malicious guest VM read and write memory belonging to other VMs on the same host, including dom0, the privileged management VM. The bugs sit in grant copy, Xen's mechanism for moving data between VMs: to speed up batches of copies within one memory page, Xen reuses earlier permission checks, and that shortcut is the root error. All Xen versions from 4.6 onward are affected; 4.5 and earlier are not. Patches exist for the unstable branch and for the 4.17.x and 4.18.x lines, but none cover versions 4.6 through 4.16, and 4.16's security support has already ended. The advisory lists no known mitigation and no observed exploitation, and names downstream platforms Qubes OS and XCP-ng as affected.
The Xen Project credited Anthropic with finding the flaws using its Claude model; Stephan Lipp of Ada Logics validated the finding, and the CodeAnt AI Security Research Team later independently reported the same issue.
Why it matters: multi-tenant virtualization is a foundation of cloud infrastructure, and a cross-VM memory flaw at the hypervisor layer undermines the isolation every tenant depends on. It is also a notable case of an AI model finding a critical vulnerability before attackers did, enterprises running Xen-based clouds should patch to a fixed branch now, since no workaround exists for older versions.