From: Jan Beulich <jbeulich@suse.com>
Subject: gnttab: properly drop page ref on a GNTTAB_cache_flush error path

Ordinary domains always have a grant table. System domains don't, but they
also don't normally "own" pages - except for DOM_IO and DOM_COW on x86.

This is XSA-520 / CVE-2026-102700.

Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reported-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3624,6 +3624,8 @@ static int _cache_flush(const gnttab_cac
     owner = page_get_owner_and_reference(page);
     if ( !owner || !owner->grant_table )
     {
+        if ( owner )
+            put_page(page);
         rcu_unlock_domain(d);
         return -EPERM;
     }