x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6571 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6571-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 18, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : xen     CVE ID         : CVE-2026-62437 CVE-2026-79602 CVE-2026-79603 CVE-2026-79604                      CVE-2026-79608 CVE-2026-79609 CVE-2026-79610 CVE-2026-79611                      CVE-2026-102699 CVE-2026-102700 CVE-2026-102702

    Multiple vulnerabilities have been discovered in the Xen hypervisor,     which could result in privilege escalation, information disclosure or     denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 4.20.4+39-gf1e1321c87-0+deb13u1.

    We recommend that you upgrade your xen packages.

    For the detailed security status of xen please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/xen

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1d448c1d40 advisory.

    x86: DMs may cause mem leak by IRQ binding [XSA-509, CVE-2026-62437]     x86: improper handling of HVM emulation return codes     [XSA-510, CVE-2026-79602]     Unconditionally do TLB flushing ahead of page scrubbing [XSA-511,     CVE-2026-79603]     oxenstored: Unbounded accumulation of watches [XSA-512, CVE-2026-79604]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a9ea805bc1 advisory.

    x86: DMs may cause mem leak by IRQ binding [XSA-509, CVE-2026-62437]     x86: improper handling of HVM emulation return codes     [XSA-510, CVE-2026-79602]     Unconditionally do TLB flushing ahead of page scrubbing [XSA-511,     CVE-2026-79603]     oxenstored: Unbounded accumulation of watches [XSA-512, CVE-2026-79604]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4090-1 advisory.

    Update to version 4.20.3 (jsc#PED-8907).

    Security issues fixed:

    - CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528).
    - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in     libfsimage iso9660       handling (bsc#1271530).
    - CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531).
    - CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532).
    - CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534).
    - CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535).
    - CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536).
    - CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537).
    - CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538).
    - CVE-2026-62434: PoD: Don't try to reclaim special pages (bsc#1271539).
    - CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding (bsc#1276838).
    - CVE-2026-79602: x86: improper handling of HVM emulation return codes (bsc#1276839).
    - CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing (bsc#1276841).
    - pygrub is only supported in de-privileged mode (bsc#1271947).

    Non security issue fixed:

    - Xen: Missing upstream bug fixes (bsc#1027519).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is     only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed     ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.
    (CVE-2026-79603)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366977	Debian dsa-6571 : libxen-dev - security update	Nessus	Debian Local Security Checks	Local	critical
362843	Fedora 44 : xen (2026-1d448c1d40)	Nessus	Fedora Local Security Checks	Local	high
362830	Fedora 43 : xen (2026-a9ea805bc1)	Nessus	Fedora Local Security Checks	Local	high
348432	SUSE SLED15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2026:4090-1)	Nessus	SuSE Local Security Checks	Local	high
344803	Xen: Stale TLB Entry Ahead of Page Scrubbing (XSA-511)	Nessus	Misc.	Local	medium
343917	Linux Distros Unpatched Vulnerability : CVE-2026-79603	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-79603

medium

Tenable Plugins

critical

high

high

high

medium

medium