CVE-2025-58150
High · 8.8CVSS
8.8
EPSS
0.1%
Published
Jan 28, 2026
CISA due date
—
The record
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | xen | 0 | 4.17.5-1.git20251028.2.mga9 |
| SUSE:Linux Enterprise Micro 5.3 | xen | 0 | 4.16.7_06-150400.4.78.1 |
| SUSE:Linux Enterprise Micro 5.4 | xen | 0 | 4.16.7_06-150400.4.78.1 |
| openSUSE:Leap 15.6 | xen | 0 | 4.18.5_10-150600.3.37.1 |
| openSUSE:Tumbleweed | xen | 0 | 4.21.0_04-1.1 |
Related vulnerabilities
- CVE-2026-23553 In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning… Also affects xen
- CVE-2024-53241 In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV… Also affects xen
- CVE-2024-53240 In the Linux kernel, the following vulnerability has been resolved: xen/netfront: fix… Also affects xen
- CVE-2024-45818 The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the… Also affects xen
- CVE-2024-45819 PVH guests have their ACPI tables constructed by the toolstack. Also affects xen
- CVE-2024-31145 Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via… Also affects xen
- CVE-2024-31146 When multiple devices share resources and one of them is to be passed through to a guest… Also affects xen
- CVE-2024-45817 In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions… Also affects xen