XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4942-1 advisory.

    - CVE-2026-79608: x86/AMD: ineffectual Zenbleed workaround (bsc#1283317).
    - CVE-2026-79609: x86: XPTI may break on huge-memory systems (bsc#1283321).
    - CVE-2026-79610: grant-table: double version change race (bsc#1283322).
    - CVE-2026-79611: VMX: VMentry failure with branch tracing and blocked states (bsc#1283323).
    - CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak (bsc#1283325).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of     XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to     the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directmap     is used. PV guests, however, have a directmap which may not cover all memory; in particular this is the     case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address boundary. (CVE-2026-79609)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-839be67202 advisory.

    x86/AMD: ineffectual Zenbleed workaround [XSA-515, CVE-2026-79608]     x86: XPTI may break on huge-memory systems [XSA-516, CVE-2026-79609]     grant-table: double version change race [XSA-517, CVE-2026-79610]     VMX: VMentry failure with branch tracing and blocked states     [XSA-518, CVE-2026-79611]     Arm: multiple issues with GNTTABOP_cache_flush     [XSA-519, CVE-2026-102699, CVE-2026-102702]     gnttab: cache-flush handling may cause page reference leak     [XSA-520, CVE-2026-102700]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4732-1 advisory.

    - CVE-2026-79609: x86: XPTI may break on huge-memory systems (bsc#1283321).
    - CVE-2026-79610: grant-table: double version change race (bsc#1283322).
    - CVE-2026-79611: VMX: VMentry failure with branch tracing and blocked states (bsc#1283323).
    - CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak (bsc#1283325).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6571 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6571-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 18, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : xen     CVE ID         : CVE-2026-62437 CVE-2026-79602 CVE-2026-79603 CVE-2026-79604                      CVE-2026-79608 CVE-2026-79609 CVE-2026-79610 CVE-2026-79611                      CVE-2026-102699 CVE-2026-102700 CVE-2026-102702

    Multiple vulnerabilities have been discovered in the Xen hypervisor,     which could result in privilege escalation, information disclosure or     denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 4.20.4+39-gf1e1321c87-0+deb13u1.

    We recommend that you upgrade your xen packages.

    For the detailed security status of xen please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/xen

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4641-1 advisory.

    Security issues fixed:

    - CVE-2026-79609: x86: XPTI may break on huge-memory systems (bsc#1283321).
    - CVE-2026-79610: grant-table: double version change race (bsc#1283322).
    - CVE-2026-79611: VMX: VMentry failure with branch tracing and blocked states (bsc#1283323).
    - CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak (bsc#1283325).

    Non security issue fixed:

    - Xen: Missing upstream bug fixes (bsc#1027519).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4642-1 advisory.

    - CVE-2026-79609: x86: XPTI may break on huge-memory systems (bsc#1283321).
    - CVE-2026-79610: grant-table: double version change race (bsc#1283322).
    - CVE-2026-79611: VMX: VMentry failure with branch tracing and blocked states (bsc#1283323).
    - CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak (bsc#1283325).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
374779	SUSE SLED15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2026:4942-1)	Nessus	SuSE Local Security Checks	Local	critical
369459	Linux Distros Unpatched Vulnerability : CVE-2026-79609	Nessus	Misc.	Local	high
369374	Fedora 44 : xen (2026-839be67202)	Nessus	Fedora Local Security Checks	Local	critical
367742	SUSE SLES12: xen / xen-devel / xen-doc-html / xen-libs / xen-libs-32bit / etc (SUSE-SU-2026:4732-1)	Nessus	SuSE Local Security Checks	Local	high
366977	Debian dsa-6571 : libxen-dev - security update	Nessus	Debian Local Security Checks	Local	critical
366057	SUSE SLES15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2026:4641-1)	Nessus	SuSE Local Security Checks	Local	high
366037	SUSE SLES15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2026:4642-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2026-79609

high

Tenable Plugins

critical

high

critical

high

critical

high

high