Xenbleed: Xen Guest to Dom0 Escape

CodeAnt AI researchers report a Xen grant-copy flaw, fixed in XSA-523 on November 3, that lets a guest with kernel-level control read and write dom0 memory. A batch cache reused locked domains after a failed grant lookup, skipping the check limiting direct frame numbers to the caller's own memory. They reproduced it on XenServer 9 and ran reversible code in dom0's kernel, on one pCPU and one kernel image. Xen lists no mitigation. Dates, severity scores and the 2015 origin come from CodeAnt alone.