AI
A Claude-assisted audit finds a two-flaw guest escape in Xen's grant copy
The Xen Project published advisory XSA-523 for CVE-2026-102703 and CVE-2026-102704, two validation errors in the grant-copy path that let a malicious guest read and write memory belonging to other domains, including Dom0. Every Xen release from 4.6 onward is affected; 4.5 and earlier are not. The advisory credits Anthropic, using Claude, with the discovery. Patches exist for 4.17 through unstable and there is no known mitigation short of applying them.