From ca4c5d8b4cb69fb985d7d175e8cecec3ebae9686 Mon Sep 17 00:00:00 2001 From: Roger Pau Monne Date: Tue, 17 Feb 2026 09:33:43 +0100 Subject: [PATCH] x86/p2m: issue a sync flush before freeing paging pages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In the EPT implementation, the defer flushing logic is used unconditionally, and that would lead to paging memory being returned to the paging pool before its references had been flushed. Issue any pending flushes before freeing the paging memory back to the pool. Note AMD (NPT) and Shadow paging are not affected, as they don't implement the deferred flushing logic. This is XSA-480 / CVE-2026-23554 Fixes: 4a59e6bb3a96 ("x86/EPT: squash meaningless TLB flush") Signed-off-by: Roger Pau Monné Reviewed-by: Jan Beulich (cherry picked from commit 4bc2e5333abb37b9a67e44d7d6c712247e5e5146) --- xen/arch/x86/mm/p2m.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c index 5014caa173..6412d83367 100644 --- a/xen/arch/x86/mm/p2m.c +++ b/xen/arch/x86/mm/p2m.c @@ -459,6 +459,11 @@ void p2m_free_ptp(struct p2m_domain *p2m, struct page_info *pg) ASSERT(p2m->domain); ASSERT(p2m->domain->arch.paging.free_page); + /* + * Issue any pending flush here, in case it was deferred before. The page + * will be returned to the paging pool now. + */ + p2m_tlb_flush_sync(p2m); page_list_del(pg, &p2m->pages); p2m->domain->arch.paging.free_page(p2m->domain, pg);