Improper error handling in Xen - CVE-2025-27465
Published: July 1, 2025
Vulnerability identifier: #VU112090
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-27465
CWE-ID: CWE-388
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local guest to crash the hypervisor.
The vulnerability exists die to incorrect stubs exception handling for flags recovery. A malicious guest can force the hypervisor to crash.
Affected software
Xen
Debian Linux
Fedora
Citrix XenServer
xen (Debian package)
xen
Debian Linux
Fedora
Citrix XenServer
xen (Debian package)
xen
How to mitigate CVE-2025-27465
Install updates from vendor's website.
xen (Debian package) - addressed in versions 4.17.5+72-g01140da4e8-1, 4.20.2+7-g1badcf5035-0+deb13u1
xen - addressed in versions 4.19.3-1.fc41, 4.19.3-2.fc42
xen - addressed in versions 4.19.3-1.fc41, 4.19.3-2.fc42