CVE-2025-1713 deadlock potential with VT-d and legacy PCI device pass-through
A deadlock in Xen hypervisor when passing through legacy PCI devices can cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1713?
CVE-2025-1713 is a high-severity denial of service vulnerability in Xen Xen, published on 17 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This lookup, itself involving acquiring of a lock, is done in a context where acquiring that lock is unsafe. This can lead to a deadlock.
Weakness: CWE-833
Which versions are affected by CVE-2025-1713?
It affects 1 product.
Linux distribution packages (4)
xen SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 4.18.4_06-150600.3.20.1 |
xen SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 4.18.4_06-150600.3.20.1 |
xen openSUSE:Leap 15.6 | All versions | 4.18.4_06-150600.3.20.1 |
xen openSUSE:Tumbleweed | All versions | 4.20.0_08-4.1 |
Products include Xen Xen.
How do I fix CVE-2025-1713?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-1713 being exploited?
There is no known exploitation of CVE-2025-1713 in the wild and no public exploit code.
Other vulnerabilities in Xen Xen
Sources
Also known as ALPINE-CVE-2025-1713, DEBIAN-CVE-2025-1713, GHSA-h63j-vf47-m3ch, SUSE-SU-2025:1162-1, UBUNTU-CVE-2025-1713, openSUSE-SU-2025:14860-1.