Xen Tapdisk flaws let guests run code as root in dom0
Two out-of-bounds bugs in the userspace block backend give a malicious VM a direct path to host compromise.
Xen has published XSA-513 covering two out-of-bounds access flaws in Tapdisk that allow a malicious guest to obtain code execution inside dom0.
Tapdisk is the userspace xen-blkback implementation used by the XAPI toolstack. It ordinarily runs as root. A guest that can reach either bug therefore gains a straightforward route to privileged code execution on the host. Every version of Tapdisk is affected, and the Xen security team states there are no mitigations.
CVE-2026-79605 is a missing upper bound check on a sector field. A crafted value causes Tapdisk to read or write beyond the mapped grant.
CVE-2026-79606 is an incorrect bounds check on a segment array. Certain segment counts corrupt adjacent memory inside the process.
Both issues were found by Jihwan Yoon of NAVER Cloud and reported via XenServer. Patches released with the advisory resolve the problems; operators running XAPI-based stacks need to deploy them.