CVE-2025-58147 x86: Incorrect input sanitisation in Viridian hypercalls
Out-of-bounds writes in Xen hypervisor Viridian hypercalls allow guest-to-host code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58147?
CVE-2025-58147 is a high-severity memory corruption vulnerability in Xen Xen, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs.
* CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format.
* CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.
Weakness: CWE-125
Which versions are affected by CVE-2025-58147?
It affects 1 product.
Linux distribution packages (1)
xen openSUSE:Tumbleweed | All versions | 4.20.1_06-1.1 |
Products include Xen Xen.
How do I fix CVE-2025-58147?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-58147 being exploited?
There is no known exploitation of CVE-2025-58147 in the wild and no public exploit code.
Other vulnerabilities in Xen Xen
Sources
Also known as ALPINE-CVE-2025-58147, DEBIAN-CVE-2025-58147, GHSA-64c5-3xxf-ccjp, UBUNTU-CVE-2025-58147, openSUSE-SU-2025:15673-1.