CVE-2026-79602

Executive Summary

CVE-2026-79602 is an unpatched denial-of-service (DoS) vulnerability in the Xen hypervisor. A guest virtual machine with a PCI device assigned that exposes at least one Base Address Register (BAR) mapped to I/O port space can trigger a BUG() condition within the hypervisor, causing a crash of the entire host domain. This affects any Xen deployment utilizing PCI passthrough, including cloud providers, virtualized server infrastructure, and enterprise virtualization environments. The vulnerability requires privileged guest access (a guest administrator) and is consequently rated as moderate severity, but the blast radius is a complete denial of service for all tenants on the affected physical host. At the time of writing, no vendor patch exists, and no public exploit code has been observed in the wild.

Technical Analysis

The vulnerability resides in the Xen hypervisor's handling of PCI device BARs (Base Address Registers) assigned to guests via PCI passthrough (also known as device assignment or direct device assignment). PCI devices expose up to six BARs, each of which can be mapped to either memory space or I/O port space, as determined by bit 0 of the BAR value. The NVD description states that a guest with a PCI device assigned that "has at least a BAR on the IO port space" can trigger a BUG() in Xen.

The BUG() macro in Xen is a fatal assertion mechanism that, when hit, halts the processor and, depending on the configured behavior, either panics the entire host or enters a crash debug state. This is distinct from a recoverable error path (e.g., returning an error code to the guest). Triggering a BUG() in hypervisor code almost invariably results in a complete host crash or reboot, since the hypervisor cannot gracefully continue execution after such an assertion failure.

The precise code path that leads to the BUG() condition is not disclosed in the NVD description. Based on established Xen architecture, the most plausible mechanism is an inconsistency between the hypervisor's internal data structures tracking guest I/O permissions and the actual state of the assigned PCI device's BAR configuration. The Xen hypervisor maintains an I/O permission bitmap per domain (guest VM) that governs which I/O ports each guest may access. When a PCI device with an I/O-mapped BAR is assigned to a guest, the hypervisor must program that guest's I/O permission bitmap to allow access to the I/O ports covered by that BAR. If a guest subsequently triggers a device reset, a BAR reconfiguration, or a hot-unplug operation, the hypervisor's code that revokes or adjusts the I/O permissions may encounter an inconsistent state—for example, attempting to remove an I/O range that was never granted—leading to the BUG() assertion.

Another plausible mechanism involves the interaction between the guest's ability to modify PCI configuration space via the PCI I/O port mechanism (0xCF8/0xCFC) and the hypervisor's emulation layer. A guest that writes an invalid value to the BAR, causing it to decode an unexpected I/O window, could cause the hypervisor's I/O permission management routines to encounter an out-of-bounds or contradictory state when recalculating the bitmap. Since the description lacks code-level details, we cannot identify the exact function or line responsible; however, the vulnerability class is consistent with improper state validation in hypervisor I/O emulation and permission tracking.

It is worth emphasizing that this is not a memory-corruption vulnerability but rather a logic flaw leading to a kernel panic. The attacker does not gain code execution within the hypervisor; they achieve a denial-of-service condition. Insufficient technical detail is available to map the vulnerable code path to a specific function name or file.

Exploitation Scenarios

No public proof-of-concept code is available for CVE-2026-79602, and no exploit code has been observed in the wild. The attack chain below is inferred from the vulnerability class and the NVD description. Attack chain steps are described at the vulnerability-class level.

Step 1 — Reconnaissance and Target Identification: The attacker must have administrator (root) privileges inside a guest virtual machine that has at least one PCI device assigned via PCI passthrough. This requirement makes the attack viable only for tenants of cloud or hosting providers that offer raw device assignment, or for users who have already compromised a privileged process within a guest VM. The attacker first enumerates the PCI devices visible within their guest (e.g., via the lspci utility on Linux or equivalent on other guest operating systems) to identify assigned devices and examine their BAR configurations.

Step 2 — Triggering the Flaw: The attacker manipulates the configuration space of the assigned PCI device to force an inconsistent hypervisor state. At the vulnerability-class level, the attack involves performing an operation that causes the hypervisor to re-evaluate the guest's I/O port permissions in a way that violates an internal invariant. The most direct path is likely a device reset or a PCIe configuration access that modifies the device's BAR registers. The NVD description indicates that merely having an assigned device with an I/O-space BAR is a precondition, and the triggering event likely involves a guest-initiated operation on that BAR region.

Step 3 — Payload Execution: At the vulnerability-class level, no payload "execution" occurs in the traditional sense. The attacker does not deploy shellcode or corrupt memory. Instead, the guest performs a sequence of privileged PCI configuration operations (e.g., issuing a PCI reset, changing the BAR's enable bit, or unmapping the device) designed to cause the Xen hypervisor to hit the BUG() assertion. The BUG() is triggered synchronously in the hypervisor's processing path of the guest request.

Step 4 — Post-Exploitation Impact: The BUG() causes the hypervisor to halt or crash. On a Xen host, a hypervisor panic results in the entire physical host becoming unavailable, affecting not only the attacking guest but also every other guest (domains) running on that host, as well as the privileged control domain (dom0). All VMs on the host are disrupted, requiring host reboot and manual restoration of the virtualized workloads. The attacker gains nothing beyond the denial of service—no data exfiltration, no persistent access to other domains, and no hypervisor-level code execution is achieved via this flaw.

Impact Assessment

The business impact of CVE-2026-79602 is a full denial-of-service condition against the physical host running the Xen hypervisor. In a multi-tenant cloud or hosting environment, a single malicious or compromised guest can crash the entire physical server, interrupting service for all co-tenant VMs. This constitutes a single-guest-to-host availability impact with cascading effects on all other guests. The CVSS score is not available (N/A) at the time of writing; however, given the preconditions (guest-level administrator privileges, PCI device assignment enabled, a device with I/O-mapped BAR present), an estimated severity would fall in the medium-to-high range (approximately 6.0–7.0) if scored, primarily driven by the high availability impact offset by the moderate attack complexity and required privileges.

The affected systems are all Xen-based virtualization platforms where PCI passthrough is in use. This includes deployments of Xen as a standalone hypervisor, XenServer/XCP-ng installations, and cloud providers using Xen as their underlying virtualization layer (historically including large public clouds). Organizations that do not use PCI passthrough are unaffected. The blast radius is confined to the physical host; a successful exploit does not compromise data confidentiality or integrity of co-tenant guests, but the availability impact is substantial, given that recovery requires a full host reboot and the restart of all affected VMs.

The preconditions meaningfully restrict the exploitability. An attacker needs administrator-level access within a guest, and the guest must have been configured with a PCI device featuring an I/O-space BAR. In many PCIe devices, BARs are almost exclusively mapped to memory space, making I/O-space BARs uncommon in modern hardware. However, devices such as certain serial controllers, legacy VGA devices, and some network controllers still expose I/O-space BARs, so the vulnerable configuration is present in a nontrivial subset of deployments. Patch confidence is 0/4, indicating no evidence of a fix from any tracked source, and no workarounds are documented.

Detection Guidance

Detection of this vulnerability is challenging because it is triggered by guest operations that may resemble legitimate PCI administration. However, the failure mode—a hypervisor BUG() crash—produces distinctive artifacts that can be monitored.

Sigma Rule

title: Xen Hypervisor BUG on PCI IO-BAR Access
id: 4f3a2c8e-1b7d-4e6a-9c3f-2a5b8d1e7f2a
status: experimental
description: Detects Xen hypervisor crash events consistent with a BUG() triggered by guest access to assigned PCI devices with IO-space BARs (CVE-2026-79602)
author: valtersit.com Threat Intel
date: 2026/06/15
logsource:
  product: linux
  category: kernel
detection:
  selection_xen_bug:
    - 'Xen BUG at'
    - 'xen: BUG'
    - 'kernel BUG at xen'
    - 'Xen panic'
  selection_pci_context:
    - 'pci'
    - 'PCI'
    - 'BAR'
    - 'ioport'
  condition: selection_xen_bug and selection_pci_context
level: high
falsepositives:
  - Benign Xen development builds where BUG() assertions are intentionally enabled
tags:
  - attack.impact
  - attack.t1499

YARA Rule

rule Xen_PCI_IOBAR_BUG_Crash_CVE_2026_79602 {
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects Xen crash logs indicating BUG() triggered by PCI IO-BAR guest access"
        date = "2026-06-15"
        cve = "CVE-2026-79602"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79602"
    strings:
        $s1 = "Xen BUG at" ascii nocase
        $s2 = "kernel BUG at" ascii nocase
        $s3 = "BUG: unable to handle kernel" ascii nocase
        $s4 = "xen: BUG" ascii nocase
        $s5 = "ioport" ascii nocase
        $s6 = "bar" ascii nocase
        $s7 = "PCI" ascii nocase
    condition:
        uint16(0) == 0x0A0D and any of ($s1, $s2, $s3, $s4) and any of ($s5, $s6, $s7)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"Xen CVE-2026-79602 Potential Crash Indicator - PCI IO BAR BUG"; content:"Xen BUG"; nocase; content:"pci"; nocase; distance:0; content:"BAR"; nocase; distance:0; classtype:attempted-dos; sid:202679602; rev:1; metadata:created_at 2026_06_15, updated_at 2026_06_15, cve CVE-2026-79602)

Note: This Suricata rule detects network-visible artifacts by unlikely to be present. Since this is a guest-to-hypervisor interaction, network-based detection is of limited utility. This rule is best applied to trusted host-log aggregation traffic or management-plane telemetry. In most deployment scenarios, host-level log monitoring (Sigma, Wazuh, Splunk) is the appropriate detection layer.

Elastic Detection

sequence by host.name with maxspan=5m
  [ any where process.name : "*xen*" and (message : "*Xen BUG at*" or message : "*kernel BUG at*") ]
  [ any where message : "*pt*" or message : "*pci*" or message : "*BAR*" or message : "*ioport*" ]

Splunk SPL Query

index=* sourcetype=linux_messages OR sourcetype=xen*
("Xen BUG at" OR "kernel BUG at" OR "xen: BUG")
OR
("Xen panic" AND ("pci" OR "PCI" OR "BAR" OR "ioport"))
| stats count by host, _time, source
| sort - _time

Wazuh OSSEC Rule

<group name="xen, kernel,">
  <rule id="2026796" level="12">
    <decoded_as>syslog</decoded_as>
    <match>Xen BUG at|kernel BUG at|xen: BUG</match>
    <description>Xen hypervisor BUG() assertion triggered - possible CVE-2026-79602 PCI IO-BAR denial of service</description>
    <group>cve-2026-79602,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="2026797" level="12">
    <if_sid>2026796</if_sid>
    <match>pci|PCI|BAR|ioport</match>
    <description>Xen BUG() with PCI/BAR/ioport context - high confidence CVE-2026-79602 attempt</description>
    <group>cve-2026-79602,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence from any tracked source. At the time of this writing, no upstream patch or vendor advisory has been released for CVE-2026-79602.

Immediate mitigations:

1. If PCI passthrough is not a functional requirement for your Xen deployment, disable the feature entirely. On the Xen command line or in the domain configuration, refrain from granting any domU access to physical PCI functions.
2. For deployments where PCI passthrough is essential, audit all assigned devices and specifically inventory those that expose a BAR mapped to I/O port space. Devices with only memory-mapped BARs cannot trigger this vulnerability.
3. Restrict the ability to perform PCI hotplug, device reset, or configuration-space manipulation operations on assigned devices. This may be achievable via Xen's device model configuration and by minimizing the tools exposed in the guest.
4. Implement host-level crash monitoring so that any hypervisor BUG() is promptly detected. Configure the Xen hypervisor to use a crash kernel or noreboot policy so that debugging artifacts are preserved rather than automatically rebooting and losing forensic evidence.

Patch/upgrade steps: Monitor the Xen Project security mailing list and the Xen security advisory page (xenproject.org). Apply the security patch immediately upon release. When available, upgrade to the patched Xen version indicated in the advisory. Until a patch ships, treat this as an unmitigated risk for hosts with PCI passthrough.

Long-term hardening:

1. Prefer SR-IOV (Single Root I/O Virtualization) virtual functions over full device assignment wherever possible, as SR-IOV reduces the surface area of guest-accessible configuration space.
2. Where PCI passthrough is used, prefer devices with only memory-mapped BARs.
3. Apply Xen's iommu=verbose and related diagnostic flags in test environments while the vulnerability remains unpatched, to facilitate root-cause analysis should a crash occur.
4. Architect cloud workloads so that no single physical host holds multiple high-value tenants; this bounds the availability impact of any successful exploit.

References

1. NVD Entry for CVE-2026-79602: https://nvd.nist.gov/vuln/detail/CVE-2026-79602
2. Xen Project Security Advisories (monitoring page for pending advisory): https://xenproject.org/security-policy/
3. Xen Security Response Process: https://xenproject.org/developers/security/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-79602 not presently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Xen PCI Passthrough Documentation (for configuration assessment): https://wiki.xenproject.org/wiki/Xen_PCI_Passthrough

No threat actor campaigns or exploits in the wild have been reported for CVE-2026-79602 as of this report. The vulnerability is unpatched; readers should subscribe to Xen security notifications for updates.