Xen CVE-2026-102703: Guest Escape via Grant Copy

A guest kernel sends a batch of grant copy operations, and on an unpatched host the hypervisor stops checking whose memory it is copying. Xen CVE-2026-102703 and CVE-2026-102704, published together as