Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-23554 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Xen Xen. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23554 affects the Intel EPT (Extended Page Tables) paging code in the Xen hypervisor. The vulnerability stems from an optimization that defers flushing of cached EPT state until the p2m lock is dropped, allowing multiple modifications under the same locked region to trigger only a single flush. However, freeing of paging structures is not deferred until after flushing, which can leave freed pages transiently present in cached state. These stale entries may point to memory ranges not owned by the guest, enabling access to unintended memory regions. The issue is classified under CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition) with a CVSS v3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
A local attacker with low privileges (PR:L) on a guest virtual machine can exploit this vulnerability under high attack complexity (AC:H) with no user interaction required. Successful exploitation allows access to host memory regions outside the guest's ownership, potentially compromising confidentiality, integrity, and availability at a high level due to the changed scope (S:C) from guest to host context.
Xen Security Advisory 480 (XSA-480) documents the vulnerability, with details available at https://xenbits.xenproject.org/xsa/advisory-480.html and http://xenbits.xen.org/xsa/advisory-480.html. Additional discussion appears in the oss-security mailing list at http://www.openwall.com/lists/oss-security/2026/03/17/6. Practitioners should consult these advisories for patch information and mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14382
Vulnerability Data
The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging…
more
structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.2V17.2.6
Mitigating Controls (NIST 800-53 r5) AI
A reference monitor that is always invoked and analyzable structurally eliminates the non-atomic check-then-use pattern underlying TOCTOU.
Access enforcement that performs an atomic check-and-use decision directly stops the window in which a TOCTOU race can be exploited.
Process isolation limits the blast radius of a successful TOCTOU exploitation but does not remove the race itself.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.