CVE-2026-62435

This CVE exposes a TOCTOU race in grant table version switching where developers assumed structural invariants hold across a dropped-and-reacquired lock. The vulnerability has two distinct failure modes depending on version transition direction, and they carry different severity profiles. In the v1→v2 direction, reference validity can be corrupted during the transition window—this creates a guest-to-guest information leak vector where one VM might observe another's grant references in an inconsistent state. This is a controlled information disclosure risk. In the v2→v1 direction, the failure destroys status frame state—this is the more severe case because status frame corruption can lead to host compromise. A malicious guest that triggers a version downgrade while the hypervisor holds locks can poison state that persists after the transition completes. The root cause is that the lock protects both data and the relationship between version state and structural properties. When a single synchronization primitive guards two semantic concerns that vary based on runtime state, developers inevitably get the invariants wrong under code churn. This isn't a one-off mistake—it's a recurring defect class that's appeared in Linux futex code, filesystem leases, and now hypervisor grant tables. For defenders: first, determine whether your deployment ever exercises the version-switching path. Most setups boot into v1 or v2 and never transition—this is cold code that rarely gets adversarial exercise. Second, check whether your hypervisor build includes the fix that separates version-specific invariants into version-specific handlers, rather than relying on developers to reason about both dimensions. Third, instrument for version state transitions in production monitoring—the vulnerability exists in a visibility dead zone where most operators can't tell if the exposed code path has been triggered. The v2→v1 direction carries host compromise risk with potentially permanent state poisoning; this isn't a transient race window but a persistent corruption that may affect subsequent hypervisor operations.

Reviewed through automated stages and approved by a human before publication.