Linux vhost, Nix/Lix, and Xen privilege escalations

Linux, Xen, and the Nix and Lix package managers saw multiple privilege-escalation disclosures. A separate NIST PQC forum thread examined a claimed quasipolynomial attack on Classic McEliece.

Linux vhost stale IOTLB enables LPE and VM escape

An oss-security disclosure introduced CVE-2026-74580, a stale IOTLB cache bug in Linux vhost. The flaw permits local privilege escalation and virtual machine escape. Operators of KVM hosts should prioritize the fix.

Nix and Lix local root escalations

Nix and Lix jointly disclosed multiple CVEs that enable local root privilege escalation through the daemon. Fixes shipped with the October 2026 advisory. Users of either package manager need to update promptly.

Xen grant-table race allows guest-to-host escalation

Xen published XSA-517 (CVE-2026-79610) for a double version change race in the grant-table. The issue has allowed guest-to-host privilege escalation on x86 since Xen 4.0. Hosts running untrusted guests should apply the update.

Xen XPTI incomplete on huge-memory systems

XSA-516 (CVE-2026-79609) describes how XPTI can break on systems with more than 5 TiB of memory. Incomplete directmap coverage creates a privilege-escalation risk for 64-bit PV guests. Large-memory x86 deployments are affected.

Xen Arm GNTTABOP_cache_flush flaws

XSA-519 addresses CVE-2026-102699 and CVE-2026-102702, two Arm issues with GNTTABOP_cache_flush. Guests can induce hypervisor crashes or cross-domain memory corruption. Arm Xen hosts should install the fixes.

Xen tapdisk out-of-bounds access

XSA-521 (CVE-2026-102701) reports a missing bounds check in tap_ctl_connect_xenblkif() inside tapdisk. A guest can trigger a stack overflow with potential root code execution. Blktap users need the patch.

Xen Zenbleed workaround ineffective

XSA-515 (CVE-2026-79608) corrects an ineffectual Zenbleed workaround on AMD CPUs. Xen versions from 4.19.4 onward remained exposed to cross-context data leaks. AMD-based hosts should update.

Classic McEliece quasipolynomial attack claim

The NIST PQC forum debated a new eprint claiming a quasipolynomial distinguisher and heuristic decryption against Classic McEliece. The thread also contains a disclosure dispute involving Apon. Post-quantum cryptography implementers are watching the analysis.