CVE-2025-58148 x86: Incorrect input sanitisation in Viridian hypercalls
Out-of-bounds reads in Xen hypervisor Viridian hypercalls allow attackers to operate on wild pointers, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58148?
CVE-2025-58148 is a high-severity memory corruption vulnerability in Xen Xen, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs.
* CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format.
* CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.
Which versions are affected by CVE-2025-58148?
It affects 1 product.
Products include Xen Xen.
How do I fix CVE-2025-58148?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-58148 being exploited?
There is no known exploitation of CVE-2025-58148 in the wild and no public exploit code.
Other vulnerabilities in Xen Xen
Sources
Also known as ALPINE-CVE-2025-58148, DEBIAN-CVE-2025-58148, GHSA-p42f-m78x-844r, UBUNTU-CVE-2025-58148.