From a9cec77ff640abec618604695ccb28fa208c6904 Mon Sep 17 00:00:00 2001
From: Fernando Rodrigues <alpha@sigmasquadron.net>
Date: Tue, 13 Oct 2026 22:49:52 +1100
Subject: [PATCH] xen: patch with XSA-519

   Xen Security Advisory CVE-2026-102699,CVE-2026-102702 / XSA-519

            Arm: multiple issues with GNTTABOP_cache_flush

1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
   calculations involved in guests flushing caches through
   GNTTABOP_cache_flush.  Unfortunately the fix there introduced a
   calculation which may underflow, resulting in a loop which would - at
   least on 64-bit Arm - take excessively long, and which would likely
   eventually crash the hypervisor.

   This is CVE-2026-102699.

2) GNTTABOP_cache_flush may be issued on memory mapped from another
   domain using the grant table interface.  However there was no
   restriction to disallow the use of invalidate-without-clean against
   read-only grant mappings, which may corrupt the granted memory.

   This is CVE-2026-102702.

A malicious unprivileged guest may crash the hypervisor, causing a
Denial of Service (DoS) affecting the entire host, or corrupt memory
belonging to another domain.  Privilege escalation and information leaks
cannot be ruled out.

https://xenbits.xenproject.org/xsa/advisory-519.html

Not-cherry-picked-because: NixOS 26.05 ships with Xen 4.20, which requires the special xsa519-4.20-1.patch and xsa519-4.20-2.patch files. This is in contrast with unstable, which ships with Xen 4.22 and thus can use the regular patches.
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 pkgs/by-name/xe/xen/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index c1a25b83e703..62b55e3ad8e0 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -229,6 +229,15 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://xenbits.xenproject.org/xsa/xsa518-4.20.patch";
       hash = "sha256-8rWeuMwn7Nk7Q8yXCRNIp5CJCS/e5kZBpKQkkz6ETwM=";
     })
+
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa519-4.20-1.patch";
+      hash = "sha256-jA/K+J7tSFDjsYDF3TZQ0AZTYHcRHZkGufpoeuX07Qc=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xenproject.org/xsa/xsa519-4.20-2.patch";
+      hash = "sha256-iLZodjt353ZaPjrGvkOhjHtAJXuCAX79SEa3ibwNTpg=";
+    })
   ]
   ++ optionals (versionOlder finalAttrs.version "4.21") [
     # Patch `libxl` to search for `qemu-system-i386` properly.