Xen grant-copy flaws give guests arbitrary memory access; ZooKeeper patches SASL bypass and fatal snapshot recursion

Xen and Apache ZooKeeper both published high-impact security fixes in a short window, covering guest memory isolation on the hypervisor side and authorization plus availability failures in the coordination service.

The most severe disclosure is Xen Security Advisory 523. CVE-2026-102703 and CVE-2026-102704 stem from incorrect caching and checks around grant-copy batches that operate on adjacent ranges in the same page. In some cases frame numbers and grant references could be mixed up, and a restriction that allows copy-by-frame-number only against the caller’s own memory was enforced in the wrong place. A malicious guest can read and write arbitrary memory belonging to other domains, including Dom0. All Xen releases from 4.6 onward are affected; 4.5 and earlier are not. There is no known mitigation short of applying the advisory patches. The issue was found with Anthropic’s Claude, validated by Stephan Lipp of Ada Logics, and independently reported by the CodeAnt AI Security Research Team.

Apache ZooKeeper shipped two related high-severity fixes in the 3.8 and 3.9 lines.

CVE-2026-100252 is an improper-authorization bug when SASL is enabled on the client port. The server’s SASL callback accepted whatever authorization identity a client supplied, without tying it to the authenticated principal. If auth_to_local canonicalization failed (and was only logged), the client-requested identity became the session identity for ACL checks. An authenticated client whose principal was outside those rules could claim arbitrary SASL identities, including identities that map to superuser. Affected ranges were 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6; fixed releases are 3.8.8 and 3.9.7. CVSS 4.0 scored it 8.6. Credit went to cunyi li and to Prasath Jayasundar with the PayPal Cyber Security Team.

CVE-2026-115448 addresses uncontrolled recursion when serializing the data tree to a snapshot: one stack frame per znode level with no depth bound. A client that can create znodes (default root ACL is open) can nest them deeply enough that a snapshot blows the JVM stack and kills the snapshot thread, while still staying inside existing buffer limits. On restart the server rebuilds the deep tree from the transaction log and fails the startup snapshot again, so the outage persists and recovery may cost data; the same log can pull leaders and followers down together. The advisory lists 3.8.0 through 3.8.8 and 3.9.0 through 3.9.7 as in scope for the fix path to 3.8.8 or 3.9.7, with ACL and authentication lockdown as a workaround. CVSS 4.0 scored it 8.7. Reporters included Sai Sreewathsa Kovalluri, Shon Babu, and Kannan K of Innspark Solutions, again with Prasath Jayasundar and PayPal Cyber Security.

Operators running Xen 4.6+ should treat XSA-523 as urgent Dom0-risk patching. ZooKeeper 3.8/3.9 deployments using SASL or open create rights should move to the fixed 3.8.8 or 3.9.7 builds and tighten znode creation where upgrades lag.