CVE-2026-79611

Executive Summary

CVE-2026-79611 is a logic flaw in the Xen hypervisor's handling of guest VM entry (VMX VMEntry) validation that follows the architectural adjustments introduced by XSA-308. When Intel VT-x hardware-assisted virtualization is in use and a specific, architecturally legitimate CPU state combination is present — #DB intercepted, Single Stepping active, and STI/MovSS blocking active — the hypervisor rejects the VMEntry; with branch tracing enabled, a further sub-case causes the same rejection even after the XSA-308 adjustment. The resulting VMEntry failure is fatal to the affected guest, producing a denial-of-service condition against the guest domain. No public exploit code, PoC, or Nuclei template is available, and no patch has been identified from tracked sources, leaving affected Xen deployments without a vendor-confirmed fix.

Technical Analysis

The vulnerability resides in the guest-entry (VMEntry) validation performed by the hypervisor on Intel VT-x platforms. VMX VMEntry checks are designed to reject combinations of guest state that the processor cannot legally resume into. Prior to XSA-308, a legitimate state could occur in which three conditions coincide: (#DB) debug exceptions are intercepted by the hypervisor, Single Stepping (the architectural single-step trap flag) is active, and STI/MovSS (interrupt-shadow and the Move-SS blocking mechanism) is active. The processor's VMEntry checks treated this combination as invalid even though it is architecturally valid, causing an unexpected VMEntry failure. XSA-308 introduced logic to accommodate this combination.

CVE-2026-79611 identifies a further sub-case that the XSA-308 adjustment does not cover: when branch tracing (a debug/tracing facility) is enabled in addition to the above conditions. Under branch tracing, the earlier adjustment still results in a VMEntry failure. As with the original case, the VMEntry failure is fatal to the guest.

The nature of the flaw is therefore a missing or incomplete exception case in the hypervisor's guest-state validation logic — a logic/validation gap, not a memory-safety bug. The triggered condition is a legitimate guest state that the hypervisor incorrectly treats as unrecoverable at entry. Because the failure occurs at VMEntry, the guest cannot be resumed and terminates.

Affected component: the hypervisor's VMX-specific guest entry path (the logic introduced/changed by XSA-308). The precise function, structure, or file names for this path are not disclosed in the provided NVD description; the advisory text refers to the conceptual logic ("VMX VMEntry checks", "#DB intercepted", "Single Stepping", "STI/MovSS", "branch tracing") rather than concrete code symbols. No further code-level detail should be assumed beyond what is stated here.

Attack surface: the affected guest domain's ability to configure debug and tracing state (debug-exception interception, single stepping, branch tracing) in combination with interrupt-shadow conditions. The failure is reachable when such state is presented at VMEntry.

Preconditions, as derivable from the description:

• Intel VT-x (VMX) virtualization is in use.
• #DB is intercepted by the hypervisor.
• Single Stepping is active.
• STI/MovSS blocking is active.
• Branch tracing is enabled (the new sub-case).

Note: the provided data gives no CVSS base score or vector (listed as N/A); the CVSS_VECTOR field above is a class-consistent estimate that must not be treated as an authoritative vendor score. No CWE was supplied; the CWE_ID above reflects the vulnerability class (improper validation of an exceptional/logic state) and is likewise analyst-derived.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE. The following describes the attack at the vulnerability-class level, inferred strictly from the NVD description. It does not assume any specific function names, endpoints, or parameters, because none are provided.

1. Reconnaissance / target identification. The attacker must first identify a target running Xen on Intel VT-x hardware and determine whether they control or can influence a guest domain (or the debug/tracing configuration of a guest). This is typically an environment where the attacker already has a foothold in, or administrative control over, a guest VM — or where a workload can set its own debug and tracing state.

2. Triggering the flaw class. The attacker induces the specific guest CPU state that the hypervisor mishandles at VMEntry: with #DB intercepted, the guest enters Single Stepping, reaches an STI/MovSS blocked condition, and enables branch tracing. This combination is architecturally legitimate, so a guest can arrive at it through normal execution of debug/tracing operations rather than through memory corruption. When VMEntry occurs in this state, the hypervisor's validation logic rejects the entry.

3. Execution method. There is no payload in the conventional sense — the "trigger" is the state combination itself. The attacker arranges for the offending state to be present at the point of VMEntry (e.g., by driving debug/single-step/branch-tracing activity in the guest). The vulnerability class is improper condition checking (a logic gap in validation), not injection, so no exploit payload is required.

4. Post-exploitation impact. The VMEntry failure is fatal to the guest. The result is that the affected guest domain is terminated — a denial-of-service condition scoped to the guest, not (per the description) a hypervisor escape or host compromise. The description explicitly states the failure is "fatal to the guest."

Because the provided data contains no exploitation, PoC, or campaign evidence, no in-the-wild activity can be asserted. Treat the above as a fault/availability scenario rather than a demonstrated compromise chain.

Impact Assessment

The primary impact is availability loss for the affected guest domain: the VMEntry failure terminates the guest. Per the description, impact is confined to the guest ("fatal to the guest"); no host or hypervisor compromise is described, and no confidentiality or integrity consequence is stated.

Affected systems: deployments running Xen on Intel VT-x hardware where the described debug/intercept/single-step/STI-MovSS/branch-tracing state combination can occur at VMEntry. Because the provided data lists no affected version range, no fixed version, and no vendor fix, the population of at-risk builds cannot be scoped from this dataset alone; operators should treat any Xen build predating a vendor advisory addressing this sub-case as potentially affected and confirm against the upstream advisory.

Blast radius is localized to individual guest VMs that reach the trigger state; a single guest that enters the state fails at VMEntry. Whether an attacker with limited guest privileges can reliably and repeatedly induce the state determines practical exploitability. The provided data does not include a CVSS base score or vector (both N/A), so no authoritative severity subscores can be cited; the estimated vector shown in METADATA (Local, High complexity, Scope Changed, Availability High) is a class-consistent placeholder, not a vendor rating. There is no EPSS score (not yet scored by FIRST.org), no CISA KEV listing, and no known exploitation in the wild.

Business impact: for multi-tenant or production virtualized environments, guest termination can cause workload disruption, availability incidents, and potential cascading effects if critical VMs are affected. It is not, per available information, a tenant-escape risk.

Detection Guidance

Detection focuses on (a) hypervisor and guest logs evidencing VMEntry failures and guest termination under debug/tracing conditions, and (b) audit/telemetry showing abnormal or repeated enabling of single-step, debug intercept, and branch-tracing state. The rules below are generic detections for this vulnerability class; tune field names and log sources to your Xen and host instrumentation.

Sigma Rule

title: Xen VMEntry Failure Following Debug/Tracing State Combination (CVE-2026-79611)
id: 9f2c7c1a-xen-79611-vmentry
status: experimental
description: Detects hypervisor log entries indicating a VMEntry failure consistent with the CVE-2026-79611 state combination (#DB intercepted, single stepping, STI/MovSS block, branch tracing).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79611
logsource:
  product: xen
  service: hypervisor
detection:
  keywords_vmentry:
    - 'VMEntry'
    - 'VM-entry'
    - 'vmentry'
  keywords_failure:
    - 'fail'
    - 'failure'
    - 'fatal'
    - 'invalid guest state'
  keywords_context:
    - 'single step'
    - 'single-step'
    - 'branch trace'
    - 'branch tracing'
    - 'MovSS'
    - 'STI'
    - '#DB'
  condition: keywords_vmentry and keywords_failure and keywords_context
falsepositives:
  - Hypervisor debug or development builds with verbose logging
level: high

YARA Rule

rule CVE_2026_79611_Xen_VMEntry_State_Strings
{
    meta:
        description = "Detects Xen/XSA-308 related strings referencing VMEntry validation and debug/tracing state; indicative of vulnerable or instrumented hypervisor code"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79611"
        cve = "CVE-2026-79611"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $vmentry1 = "VMEntry" ascii wide nocase
        $vmentry2 = "VM-entry" ascii wide nocase
        $db = "#DB" ascii wide
        $ss = "single step" ascii wide nocase
        $movss = "MovSS" ascii wide nocase
        $bt = "branch tracing" ascii wide nocase
        $sti = "STI" ascii wide
        $xsa = "XSA-308" ascii wide
    condition:
        filesize < 20MB and
        ( $vmentry1 or $vmentry2 ) and
        ( $db or $ss ) and
        ( $bt or $movss or $sti )
}

Suricata IDS Rule

Network detection is limited for this CPU-state logic flaw because the trigger is local guest/hypervisor state, not a network payload. The rule below flags transport of hypervisor diagnostic/monitoring traffic containing VMEntry failure indicators, which may accompany induced guest failures. Adjust ports and content to your environment.

alert tcp any any -> any any (msg:"CVE-2026-79611 Possible Xen VMEntry Failure (debug/tracing state)"; flow:established,to_server; content:"VMEntry"; nocase; content:"fail"; nocase; distance:0; within:128; content:"branch tracing"; nocase; distance:0; within:256; classtype:attempted-dos; reference:cve,2026-79611; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-79611; sid:2026079611; rev:1;)

Elastic Detection

process where
  event.category == "process" and
  (
    process.name in ("xl", "xenstore", "xenstored", "qemu-system-i386", "qemu-system-x86_64") or
    process.command_line : "*debug*"
  ) and
  process.command_line : ("*singlestep*", "*single-step*", "*branch*", "*tracing*", "*movss*")

Correlating hypervisor log ingestion:

any where
  event.category == "host" and
  message : ("VMEntry*" or "VM-entry*") and
  message : ("fail*" or "fatal*") and
  message : ("single step*" or "branch trac*" or "MovSS" or "#DB")

Splunk SPL Query

index=xen OR index=hypervisor (sourcetype=xen:hypervisor OR sourcetype=syslog)
| eval m=lower(_raw)
| where (match(m,"vmentry|vm-entry")) AND (match(m,"fail|failure|fatal"))
        AND (match(m,"single.?step|branch.?trac|movss|sti|#db"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, source, _raw
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="xen,cve-2026-79611,">
  <rule id="100611" level="12">
    <decoded_as>syslog</decoded_as>
    <match>VMEntry|VM-entry</match>
    <regex type="pcre2">(?i)(fail|failure|fatal).*(single.?step|branch.?trac|movss|#db)</regex>
    <description>CVE-2026-79611: Xen VMEntry failure with debug/tracing state (possible guest DoS)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100612" level="10">
    <decoded_as>syslog</decoded_as>
    <match>branch tracing</match>
    <regex type="pcre2">(?i)vmentry|vm-entry</regex>
    <description>CVE-2026-79611: branch-tracing sub-case VMEntry failure indicator</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. No vendor fix, workaround, or affected-version range is available in the provided data. The following are general, vulnerability-class mitigations and must be validated against the upstream Xen security advisory before reliance.

1. Immediate mitigations

• Treat this as an availability risk to guest VMs. Where possible, restrict the ability of untrusted or low-trust guests to configure debug, single-step, and branch-tracing state, and avoid granting guest debug/tracing control to untrusted workloads.
• Monitor hypervisor logs for VMEntry failures matching the described state combination and alert on guest terminations that correlate with debug/tracing activity.
• Isolate environments in which debug instrumentation is routinely used; instability there is most likely to surface this condition.
• Because the trigger state is a legitimate one, avoid workflows that combine intercepted #DB, single stepping, STI/MovSS blocking, and branch tracing during active guest execution until a fix is available.

2. Patch / upgrade steps

• No patch is currently identified (patch confidence 0/4). Monitor the Xen Project security advisories page and the NVD entry for an update that extends the XSA-308 logic to cover the branch-tracing sub-case described here.
• Once a fixed Xen version is published, upgrade hypervisors per the vendor advisory and reboot affected hosts to apply the change, then re-verify that the triggering state no longer causes VMEntry failure.
• Until a fix exists, maintain compensating controls (monitoring and restriction of debug/tracing state as above) rather than treating the issue as resolved.

3. Long-term hardening

• Apply a disciplined hypervisor patch cadence and track the Xen security advisory process (XSA series) continuously, since this issue is an extension of prior advisory logic (XSA-308).
• Limit guest access to virtualization/debug features, and log/audit their use; apply least privilege to who can configure single-step and branch tracing.
• Maintain guest-level redundancy and health monitoring so that an unexpected VMEntry-induced termination is detected and recovered quickly.
• Favor hypervisor builds/components with mature validation coverage for guest-state entry paths, and include targeted regression testing of debug/tracing state combinations when adopting new hypervisor releases.

References

• NVD — CVE-2026-79611: https://nvd.nist.gov/vuln/detail/CVE-2026-79611
• Xen Project Security Advisories (XSA series; see XSA-308 as prior related logic): https://xenbits.xen.org/xsa/
• Xen Project Security Policy / advisory index: https://www.xenproject.org/security-policy.html
• FIRST EPSS (no score currently available for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on exploit-in-the-wild evidence: none identified. No public PoC, exploit code, or Nuclei template is available, and the CVE is not in CISA KEV. No threat actor campaign can be attributed from the provided data.