https://seclists.org/oss-sec/2026/q1/117: Xen Security Advisory 477 v2 (CVE-2025-58150) - x86: buffer overrun with shadow paging + tracing
Published Jan 27, 2026
·Updated
Affected Software
1 affected component
Xen Project Xen>=4.18<=4.19
Only x86 systems are affected. A vulnerable configuration requires HVM guests using shadow paging mode with tracing enabled; Arm systems are not vulnerable.
The vulnerable tracing code writes guest-controlled data whose size is also guest-controllable into per-CPU variables without adequate bounds checking. The issue can therefore be leveraged by HVM guests operating under the affected shadow-paging and tracing configuration.
Run HVM guests in HAP mode only, or disable tracing. Either measure avoids the vulnerable condition.
Bogus trace data is considered the most likely outcome, but privilege escalation, information disclosure, and denial of service cannot be excluded. The actual effect depends on what data is adjacent to the affected variables in the particular Xen build.