What’s Vulnerable › Vulnerabilities

CVE-2025-58147: x86: Incorrect input sanitisation in Viridian hypercalls

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-31 · updated 2026-10-19
• Weakness: CWE-125

Description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.

Affected products

• xen: from 4.15.0

References

• https://xenbits.xenproject.org/xsa/advisory-475.html
• http://www.openwall.com/lists/oss-security/2025/10/21/1
• http://xenbits.xen.org/xsa/advisory-475.html

Get alerted when CVE-2025-58147 or the next vulnerability affects your stack