{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "xen"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "xen"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "xen"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]  1) XSA-437 (CVE-2023-34321) addressed issues with overflows in    calculations involved in guests flushing caches through    GNTTABOP_cache_flush.  Unfortunately the fix there introduced a    calculation which may underflow, resulting in a loop which would - at    least on 64-bit Arm - take excessively long, and which would likely    eventually crash the hypervisor.     This is CVE-2026-102699.  2) GNTTABOP_cache_flush may be issued on memory mapped from another    domain using the grant table interface.  However there was no    restriction to disallow the use of invalidate-without-clean against    read-only grant mappings, which may corrupt the granted memory.     This is CVE-2026-102702.",
  "id": "DEBIAN-CVE-2026-102702",
  "modified": "2026-10-14T05:47:47.131832709Z",
  "published": "2026-10-13T16:17:09.723Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-102702"
    }
  ],
  "upstream": [
    "CVE-2026-102702"
  ]
}