CVE-2025-58150
x86: buffer overrun with shadow paging + tracing
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
x86: buffer overrun with shadow paging + tracing
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
- Record
CVE-2025-58150- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2025-206476
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
- Record
EUVD-2025-206476- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vq9r-cp35-p48q
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. ...
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
- Record
GHSA-vq9r-cp35-p48q- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
- Record
CVE-2025-58150- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-58150
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
- Record
ALPINE-CVE-2025-58150- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-58150
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
- Record
DEBIAN-CVE-2025-58150- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVUBUNTU-CVE-2025-58150
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
- Record
UBUNTU-CVE-2025-58150- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0026 No score
Updated xen packages fix security vulnerabilities
x86: buffer overrun with shadow paging + tracing. (CVE-2025-58150) x86: incomplete IBPB for vCPU isolation. (CVE-2026-23553)
- Record
MGASA-2026-0026- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10118-1 No score
xen-4.21.0_04-1.1 on GA media
These are all security issues fixed in the xen-4.21.0_04-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10118-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0303-1 No score
Security update for xen
This update for xen fixes the following issues:
Security fixes:
- CVE-2025-58150: Fixed buffer overrun with shadow paging and tracing (XSA-477) (bsc#1256745)
- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation (XSA-479) (bsc#1256747)
- CVE-2025-58149: Fixed incorrect removal od permissions on PCI device unplug allow PV guests to access memory of devices no longer assigned to it (XSA-476) (bsc#1252692)
- CVE-2025-27466, CVE-2025-58142, CVE-2025-58143: Fixed multiple vulnerabilities in the Viridian interface (XSA-472) (bsc#1248807)
Other fixes:
- Fixed virtxend service restart. Caused by a failure to start xenstored (bsc#1254180)
- Record
SUSE-SU-2026:0303-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0304-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2025-58150: Fixed buffer overrun with shadow paging and tracing (XSA-477) (bsc#1256745)
- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation (XSA-479) (bsc#1256747)
- Record
SUSE-SU-2026:0304-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0306-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2025-58150: Fixed buffer overrun with shadow paging and tracing (XSA-477) (bsc#1256745)
- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation (XSA-479) (bsc#1256747)
- Record
SUSE-SU-2026:0306-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0328-1 No score
Security update for xen
This update for xen fixes the following issues:
Security fixes:
- CVE-2025-58150: Fixed buffer overrun with shadow paging and tracing (XSA-477) (bsc#1256745)
- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation (XSA-479) (bsc#1256747)
- CVE-2025-58149: Fixed incorrect removal od permissions on PCI device unplug allow PV guests to access memory of devices no longer assigned to it (XSA-476) (bsc#1252692)
- Record
SUSE-SU-2026:0328-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0329-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2025-58150: Fixed buffer overrun with shadow paging and tracing (XSA-477) (bsc#1256745)
- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation (XSA-479) (bsc#1256747)
- Record
SUSE-SU-2026:0329-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0394-1 No score
Security update for xen
This update for xen fixes the following issues:
Security fixes:
- CVE-2025-58150: Fixed buffer overrun with shadow paging and tracing (XSA-477) (bsc#1256745)
- CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation (XSA-479) (bsc#1256747)
- CVE-2025-58149: Fixed incorrect removal od permissions on PCI device unplug allow PV guests to access memory of devices no longer assigned to it (XSA-476) (bsc#1252692)
Other fixes:
- Fixed virtxend service restart. Caused by a failure to start xenstored (bsc#1254180)
- Record
SUSE-SU-2026:0394-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0589-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2025-58150: buffer overrun with shadow paging + tracing (XSA-477) (bsc#1256745).
- CVE-2026-23553: incomplete IBPB for vCPU isolation (XSA-479) (bsc#1256747).
- Record
SUSE-SU-2026:0589-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenAlpine:v3.20 |
before 4.18.5-r4 | 4.18.5-r4 |
xenAlpine:v3.21 |
before 4.19.4-r1 | 4.19.4-r1 |
xenAlpine:v3.22 |
before 4.20.2-r1 | 4.20.2-r1 |
xenAlpine:v3.23 |
before 4.20.2-r1 | 4.20.2-r1 |
xenAlpine:v3.24 |
before 4.21.0-r2 | 4.21.0-r2 |
xenDebian:12 |
before 4.17.7-0+deb12u1, plus listed versions 4.17.1+2-gb773c48e36-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1~deb12u14.17.2-1 Show 9 moreShow less4.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.14.17.3+10-g091466ba55-1.1~exp14.17.3+10-g091466ba55-1.1~exp24.17.3+10-g091466ba55-1~deb12u14.17.3+36-g54dacb5c02-14.17.5+23-ga4e5191dc0-14.17.5+23-ga4e5191dc0-1+deb12u14.17.5+72-g01140da4e8-1 |
4.17.7-0+deb12u1 |
xenDebian:13 |
before 4.20.2+37-g61ff35323e-0+deb13u1, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+7-g1badcf5035-0+deb13u14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-2 |
4.20.2+37-g61ff35323e-0+deb13u1 |
xenDebian:14 |
before 4.20.2+37-g61ff35323e-1, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-2 |
4.20.2+37-g61ff35323e-1 |
xenMageia:9 |
before 4.17.5-1.git20251028.2.mga9 | 4.17.5-1.git20251028.2.mga9 |
xenSUSE:Linux Enterprise Micro 5.2 |
before 4.14.6_28-150300.3.94.1 | 4.14.6_28-150300.3.94.1 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xenSUSE:Linux Enterprise Micro 5.5 |
before 4.17.6_04-150500.3.59.1 | 4.17.6_04-150500.3.59.1 |
xenopenSUSE:Leap 15.6 |
before 4.18.5_10-150600.3.37.1 | 4.18.5_10-150600.3.37.1 |
xenSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 4.12.4_64-3.137.1 | 4.12.4_64-3.137.1 |
xenSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 4.20.2_04-150700.3.22.1 | 4.20.2_04-150700.3.22.1 |
xenSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 4.20.2_04-150700.3.22.1 | 4.20.2_04-150700.3.22.1 |
xenSUSE:Linux Enterprise Micro 5.3 |
before 4.16.7_06-150400.4.78.1 | 4.16.7_06-150400.4.78.1 |
xenSUSE:Linux Enterprise Micro 5.4 |
before 4.16.7_06-150400.4.78.1 | 4.16.7_06-150400.4.78.1 |
xenSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 4.20.2_06-150700.3.25.1 | 4.20.2_06-150700.3.25.1 |
xenSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 4.20.2_06-150700.3.25.1 | 4.20.2_06-150700.3.25.1 |
xenUbuntu:16.04:LTS |
All versions, plus listed versions 4.5.1-0ubuntu14.5.1-0ubuntu24.6.0-1ubuntu14.6.0-1ubuntu24.6.0-1ubuntu4 Show 7 moreShow less4.6.0-1ubuntu4.14.6.0-1ubuntu4.24.6.0-1ubuntu4.34.6.5-0ubuntu14.6.5-0ubuntu1.14.6.5-0ubuntu1.24.6.5-0ubuntu1.4 |
None known |
xenUbuntu:18.04:LTS |
All versions, plus listed versions 4.9.0-0ubuntu34.9.0-0ubuntu44.9.2-0ubuntu1 |
None known |
xenUbuntu:20.04:LTS |
All versions, plus listed versions 4.9.2-0ubuntu24.9.2-0ubuntu64.9.2-0ubuntu74.11.3+24-g14b62ab3e5-1ubuntu14.11.3+24-g14b62ab3e5-1ubuntu24.11.3+24-g14b62ab3e5-1ubuntu2.24.11.3+24-g14b62ab3e5-1ubuntu2.3 |
None known |
xenUbuntu:22.04:LTS |
All versions, plus listed versions 4.11.4+24-gddaaccbbab-1ubuntu24.16.0-1~ubuntu24.16.0-1~ubuntu2.1 |
None known |
xenUbuntu:24.04:LTS |
All versions, plus listed versions 4.17.2-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1ubuntu14.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.1ubuntu24.17.3+10-g091466ba55-1.1ubuntu3 |
None known |
xenUbuntu:25.10 |
All versions, plus listed versions 4.20.0-1ubuntu14.20.0+68-g35cb38b222-1 |
None known |
xenUbuntu:26.10 |
All versions, plus listed versions 4.20.2+7-g1badcf5035-2build24.20.2+37-g61ff35323e-1ubuntu14.20.3+127-gc42374a105-1 |
None known |
xenUbuntu:26.04:LTS |
All versions, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+7-g1badcf5035-24.20.2+7-g1badcf5035-2build2 |
None known |
xenopenSUSE:Tumbleweed |
before 4.21.0_04-1.1 | 4.21.0_04-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-58150 is a high vulnerability (CVSS 8.8) in Xen, published January 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in xen 4.18.5-r4.
References
xenbits.xenproject.org/xsa/advisory-477.html
openwall.com/lists/oss-security/2026/01/27/1
xenbits.xen.org/xsa/advisory-477.html
nvd.nist.gov/vuln/detail/CVE-2025-58150
github.com/advisories/GHSA-vq9r-cp35-p48q
security.alpinelinux.org/vuln/CVE-2025-58150
Show 25 moreShow less
security-tracker.debian.org/tracker/CVE-2025-58150
advisories.mageia.org/MGASA-2026-0026.html
bugs.mageia.org/show_bug.cgi?id=35074
suse.com/support/update/announcement/2026/suse-su-20260303-1
bugzilla.suse.com/1248807
ubuntu.com/security/CVE-2025-58150
cve.org/CVERecord?id=CVE-2025-58150