{"kind": "product", "path": "vulns/ubuntu-25.10/xen", "name": "xen", "product": "xen", "ecosystem": "Ubuntu:25.10", "items": [{"id": "CVE-2026-23556", "noindex": false, "published": "2026-07-09T14:48:56.630Z", "modified": "2026-07-09T15:37:46.026Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00137, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-23556", "title": "oxenstored keeps quota related use counts across domain destruction", "description": "When oxenstored is tearing a domain down, the node data is cleaned up\nbut the usage counts are leaked.\n\nWhen the domain ID is eventually reused, the new domain can create fewer\nnodes before beeing deemed to be over quota.", "references": ["https://xenbits.xen.org/xsa/advisory-483.html", "http://www.openwall.com/lists/oss-security/2026/04/28/10", "http://xenbits.xen.org/xsa/advisory-483.html"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42488", "noindex": false, "published": "2026-06-18T13:47:23.838Z", "modified": "2026-06-18T15:07:35.190Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00353, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42488", "title": "x86: mismatched mapcache metadata", "description": "Some shadow paging errors paths will switch the page-tables without\nupdating the currently running vCPU reference.  This causes a mismatch\nbetween the loaded page-tables and the mapcache metadata which can lead\nto corruption of the mapcache.", "references": ["https://xenbits.xenproject.org/xsa/advisory-494.html", "http://xenbits.xen.org/xsa/advisory-494.html", "http://www.openwall.com/lists/oss-security/2026/06/09/14"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42490", "noindex": false, "published": "2026-06-18T13:47:13.257Z", "modified": "2026-06-18T15:04:50.692Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.002, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42490", "title": "domctl lock open to abuse", "description": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo create and manage guests, domctl operations are used by the control\ndomain, a possible Xenstore domain, or by a domain controlling a\nparticular guest.  Some of these operations may not be executed in\nparallel, so a system-wide lock is used.  The way that lock is acquired\nis, however, not providing any fairness.  This is CVE-2026-42489.\n\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.  This is\nCVE-2026-42490.", "references": ["https://xenbits.xenproject.org/xsa/advisory-492.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42490"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42489", "noindex": false, "published": "2026-06-18T13:47:13.198Z", "modified": "2026-06-18T15:04:32.591Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "severity": "medium", "epss": 0.00078, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42489", "title": "domctl lock open to abuse", "description": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo create and manage guests, domctl operations are used by the control\ndomain, a possible Xenstore domain, or by a domain controlling a\nparticular guest.  Some of these operations may not be executed in\nparallel, so a system-wide lock is used.  The way that lock is acquired\nis, however, not providing any fairness.  This is CVE-2026-42489.\n\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.  This is\nCVE-2026-42490.", "references": ["https://xenbits.xenproject.org/xsa/advisory-492.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42489"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42487", "noindex": false, "published": "2026-06-18T13:46:53.459Z", "modified": "2026-06-18T15:07:31.335Z", "cvss": 7.9, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "severity": "high", "epss": 0.00095, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42487", "title": "x86 HVM I/O port list traversal", "description": "HVM guest I/O port accesses are subject to either emulation or at least\ntranslation.  Translations are managed by the device model (via\nXEN_DOMCTL_ioport_mapping), and hence the linked list used may changed\nat any time.  Traversal of those lists (while handling guest I/O port\naccesses) therefore needs synchronizing with updates, which was missing\nso far.", "references": ["https://xenbits.xenproject.org/xsa/advisory-491.html", "http://xenbits.xen.org/xsa/advisory-491.html", "http://www.openwall.com/lists/oss-security/2026/06/09/11"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-10263", "noindex": false, "published": "2026-06-09T09:23:18.802Z", "modified": "2026-09-04T12:04:56.776Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00544, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-10263", "title": "CVE-2025-10263", "description": "Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.", "references": ["https://developer.arm.com/documentation/112137", "http://xenbits.xen.org/xsa/advisory-493.html", "http://www.openwall.com/lists/oss-security/2026/06/09/13"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-23558", "noindex": false, "published": "2026-05-19T12:49:54.652Z", "modified": "2026-05-20T03:55:35.327Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00117, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-23558", "title": "grant table v2 race in status page mapping", "description": "The adjustments made for XSA-379 as well as those subsequently becoming\nXSA-387 still left a race window, when a HVM or PVH guest does a grant\ntable version change from v2 to v1 in parallel with mapping the status\npage(s) via XENMEM_add_to_physmap.  Some of the status pages may then be\nfreed while mappings of them would still be inserted into the guest's\nsecondary (P2M) page tables.", "references": ["https://xenbits.xenproject.org/xsa/advisory-486.html", "http://www.openwall.com/lists/oss-security/2026/04/28/13", "http://xenbits.xen.org/xsa/advisory-486.html"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-23557", "noindex": false, "published": "2026-05-19T12:49:42.202Z", "modified": "2026-05-19T14:42:45.464Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "severity": "medium", "epss": 0.00158, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-23557", "title": "Xenstored DoS via XS_RESET_WATCHES command", "description": "Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES\ncommand within a transaction due to an assert() triggering.\n\nIn case xenstored was built with NDEBUG #defined nothing bad will\nhappen, as assert() is doing nothing in this case. Note that the\ndefault is not to define NDEBUG for xenstored builds even in release\nbuilds of Xen.", "references": ["https://xenbits.xenproject.org/xsa/advisory-484.html", "http://www.openwall.com/lists/oss-security/2026/04/28/11", "http://xenbits.xen.org/xsa/advisory-484.html"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-54518", "noindex": false, "published": "2026-05-15T03:06:30.822Z", "modified": "2026-09-10T12:04:59.419Z", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00287, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-54518", "title": "CVE-2025-54518", "description": "Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.", "references": ["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7052.html", "http://www.openwall.com/lists/oss-security/2026/05/12/15", "http://xenbits.xen.org/xsa/advisory-490.html"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-54505", "noindex": false, "published": "2026-04-27T15:16:04.613Z", "modified": "2026-04-29T03:04:47.232Z", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00191, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-54505", "title": "CVE-2025-54505", "description": "A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially resulting in loss of confidentiality.", "references": ["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7053.html", "http://xenbits.xen.org/xsa/advisory-488.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-54505"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-23555", "noindex": false, "published": "2026-03-23T06:57:07.653Z", "modified": "2026-03-23T14:14:02.810Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "severity": "high", "epss": 0.00184, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-23555", "title": "Xenstored DoS by unprivileged domain", "description": "Any guest issuing a Xenstore command accessing a node using the\n(illegal) node path \"/local/domain/\", will crash xenstored due to a\nclobbered error indicator in xenstored when verifying the node path.\n\nNote that the crash is forced via a failing assert() statement in\nxenstored. In case xenstored is being built with NDEBUG #defined,\nan unprivileged guest trying to access the node path \"/local/domain/\"\nwill result in it no longer being serviced by xenstored, other guests\n(including dom0) will still be serviced, but xenstored will use up\nall cpu time it can get.", "references": ["https://xenbits.xenproject.org/xsa/advisory-481.html", "http://www.openwall.com/lists/oss-security/2026/03/17/7", "http://xenbits.xen.org/xsa/advisory-481.html"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-23554", "noindex": false, "published": "2026-03-23T06:56:52.344Z", "modified": "2026-03-23T14:19:27.752Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.0013, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-23554", "title": "Use after free of paging structures in EPT", "description": "The Intel EPT paging code uses an optimization to defer flushing of any cached\nEPT state until the p2m lock is dropped, so that multiple modifications done\nunder the same locked region only issue a single flush.\n\nFreeing of paging structures however is not deferred until the flushing is\ndone, and can result in freed pages transiently being present in cached state.\nSuch stale entries can point to memory ranges not owned by the guest, thus\nallowing access to unintended memory regions.", "references": ["https://xenbits.xenproject.org/xsa/advisory-480.html", "http://www.openwall.com/lists/oss-security/2026/03/17/6", "http://xenbits.xen.org/xsa/advisory-480.html"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-23553", "noindex": false, "published": "2026-01-28T15:33:44.782Z", "modified": "2026-01-28T16:41:14.803Z", "cvss": 2.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-23553", "title": "x86: incomplete IBPB for vCPU isolation", "description": "In the context switch logic Xen attempts to skip an IBPB in the case of\na vCPU returning to a CPU on which it was the previous vCPU to run.\nWhile safe for Xen's isolation between vCPUs, this prevents the guest\nkernel correctly isolating between tasks.  Consider:\n\n 1) vCPU runs on CPU A, running task 1.\n 2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.\n 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.\n 4) vCPU moves back to CPU A.  Xen skips IBPB again.\n\nNow, task 2 is running on CPU A with task 1's training still in the BTB.", "references": ["https://xenbits.xenproject.org/xsa/advisory-479.html", "http://www.openwall.com/lists/oss-security/2026/01/27/3", "http://xenbits.xen.org/xsa/advisory-479.html"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-58150", "noindex": false, "published": "2026-01-28T15:33:17.316Z", "modified": "2026-01-28T16:46:04.355Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00148, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-58150", "title": "x86: buffer overrun with shadow paging + tracing", "description": "Shadow mode tracing code uses a set of per-CPU variables to avoid\ncumbersome parameter passing.  Some of these variables are written to\nwith guest controlled data, of guest controllable size.  That size can\nbe larger than the variable, and bounding of the writes was missing.", "references": ["https://xenbits.xenproject.org/xsa/advisory-477.html", "http://www.openwall.com/lists/oss-security/2026/01/27/1", "http://xenbits.xen.org/xsa/advisory-477.html"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-58149", "noindex": false, "published": "2025-10-31T11:50:39.536Z", "modified": "2025-11-04T21:13:31.524Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00435, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-58149", "title": "Incorrect removal of permissions on PCI device unplug", "description": "When passing through PCI devices, the detach logic in libxl won't remove\naccess permissions to any 64bit memory BARs the device might have.  As a\nresult a domain can still have access any 64bit memory BAR when such\ndevice is no longer assigned to the domain.\n\nFor PV domains the permission leak allows the domain itself to map the memory\nin the page-tables.  For HVM it would require a compromised device model or\nstubdomain to map the leaked memory into the HVM domain p2m.", "references": ["https://xenbits.xenproject.org/xsa/advisory-476.html", "http://xenbits.xen.org/xsa/advisory-476.html", "http://www.openwall.com/lists/oss-security/2025/10/24/1"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-58148", "noindex": false, "published": "2025-10-31T11:50:28.407Z", "modified": "2025-11-04T21:13:30.190Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.0038, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-58148", "title": "x86: Incorrect input sanitisation in Viridian hypercalls", "description": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\none of three formats.  Xen has boundary checking bugs with all three\nformats, which can cause out-of-bounds reads and writes while processing\nthe inputs.\n\n * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can\n   cause vpmask_set() to write out of bounds when converting the bitmap\n   to Xen's format.\n\n * CVE-2025-58148.  Hypercalls using any input format can cause\n   send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wil", "references": ["https://xenbits.xenproject.org/xsa/advisory-475.html", "http://xenbits.xen.org/xsa/advisory-475.html", "http://www.openwall.com/lists/oss-security/2025/10/21/1"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-58147", "noindex": false, "published": "2025-10-31T11:50:28.282Z", "modified": "2025-11-04T21:13:28.853Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.0038, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-58147", "title": "x86: Incorrect input sanitisation in Viridian hypercalls", "description": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\none of three formats.  Xen has boundary checking bugs with all three\nformats, which can cause out-of-bounds reads and writes while processing\nthe inputs.\n\n * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can\n   cause vpmask_set() to write out of bounds when converting the bitmap\n   to Xen's format.\n\n * CVE-2025-58148.  Hypercalls using any input format can cause\n   send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wil", "references": ["https://xenbits.xenproject.org/xsa/advisory-475.html", "http://xenbits.xen.org/xsa/advisory-475.html", "http://www.openwall.com/lists/oss-security/2025/10/21/1"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-58145", "noindex": false, "published": "2025-09-11T14:05:36.380Z", "modified": "2025-11-04T21:13:27.555Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00352, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-58145", "title": "Arm issues with page refcounting", "description": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are two issues related to the mapping of pages belonging to other\ndomains: For one, an assertion is wrong there, where the case actually\nneeds handling.  A NULL pointer de-reference could result on a release\nbuild.  This is CVE-2025-58144.\n\nAnd then the P2M lock isn't held until a page reference was actually\nobtained (or the attempt to do so has failed).  Otherwise the page can\nnot only change type, but even ownership in between, thus allowing\ndomain boundaries to be violated.  This is CVE-2025-58145.", "references": ["https://xenbits.xenproject.org/xsa/advisory-473.html", "http://xenbits.xen.org/xsa/advisory-473.html", "http://www.openwall.com/lists/oss-security/2025/09/09/2"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-58144", "noindex": false, "published": "2025-09-11T14:05:36.284Z", "modified": "2025-11-04T21:13:26.232Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0045, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-58144", "title": "Arm issues with page refcounting", "description": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are two issues related to the mapping of pages belonging to other\ndomains: For one, an assertion is wrong there, where the case actually\nneeds handling.  A NULL pointer de-reference could result on a release\nbuild.  This is CVE-2025-58144.\n\nAnd then the P2M lock isn't held until a page reference was actually\nobtained (or the attempt to do so has failed).  Otherwise the page can\nnot only change type, but even ownership in between, thus allowing\ndomain boundaries to be violated.  This is CVE-2025-58145.", "references": ["https://xenbits.xenproject.org/xsa/advisory-473.html", "http://xenbits.xen.org/xsa/advisory-473.html", "http://www.openwall.com/lists/oss-security/2025/09/09/2"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-58143", "noindex": false, "published": "2025-09-11T14:05:29.729Z", "modified": "2025-11-04T21:13:24.914Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00379, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-58143", "title": "Mutiple vulnerabilities in the Viridian interface", "description": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are multiple issues related to the handling and accessing of guest\nmemory pages in the viridian code:\n\n 1. A NULL pointer dereference in the updating of the reference TSC area.\n    This is CVE-2025-27466.\n\n 2. A NULL pointer dereference by assuming the SIM page is mapped when\n    a synthetic timer message has to be delivered.  This is\n    CVE-2025-58142.\n\n 3. A race in the mapping of the reference TSC page, where a guest can\n    get Xen to free a page while still present in the guest physical to\n    machine (", "references": ["https://xenbits.xenproject.org/xsa/advisory-472.html", "http://xenbits.xen.org/xsa/advisory-472.html", "http://www.openwall.com/lists/oss-security/2025/09/09/1"], "fixes": [], "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}]}], "total": 127, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 7, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "xen", "path": "vulns/ubuntu-25.10/xen", "ecosystem": "Ubuntu:25.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-10T12:04:59.419Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}