https://seclists.org/oss-sec/2026/q1/117: Xen Security Advisory 477 v2 (CVE-2025-58150) - x86: buffer overrun with shadow paging + tracing

Q: Which Xen deployments are exposed to this issue?

Only x86 systems are affected. A vulnerable configuration requires HVM guests using shadow paging mode with tracing enabled; Arm systems are not vulnerable.

Q: What must an attacker be able to control to trigger the flaw?

The vulnerable tracing code writes guest-controlled data whose size is also guest-controllable into per-CPU variables without adequate bounds checking. The issue can therefore be leveraged by HVM guests operating under the affected shadow-paging and tracing configuration.

Q: What can be done if an update cannot be applied immediately?

Run HVM guests in HAP mode only, or disable tracing. Either measure avoids the vulnerable condition.

Q: What impact should be considered during triage?

Bogus trace data is considered the most likely outcome, but privilege escalation, information disclosure, and denial of service cannot be excluded. The actual effect depends on what data is adjacent to the affected variables in the particular Xen build.

Published Jan 27, 2026

Updated

Affected Software

1 affected component

Xen Project Xen>=4.18<=4.19

Frequently Asked Questions

Which Xen deployments are exposed to this issue?

Only x86 systems are affected. A vulnerable configuration requires HVM guests using shadow paging mode with tracing enabled; Arm systems are not vulnerable.

What must an attacker be able to control to trigger the flaw?

The vulnerable tracing code writes guest-controlled data whose size is also guest-controllable into per-CPU variables without adequate bounds checking. The issue can therefore be leveraged by HVM guests operating under the affected shadow-paging and tracing configuration.

What can be done if an update cannot be applied immediately?

Run HVM guests in HAP mode only, or disable tracing. Either measure avoids the vulnerable condition.

What impact should be considered during triage?

Bogus trace data is considered the most likely outcome, but privilege escalation, information disclosure, and denial of service cannot be excluded. The actual effect depends on what data is adjacent to the affected variables in the particular Xen build.