CVE-2025-58142

The viridian code in Xen incorrectly assumes that the SIM (Synthetic Interrupt Message) page is always mapped when a synthetic timer message needs to be delivered. If the page is not actually mapped, a NULL pointer dereference occurs. The bug is in the Hyper-V interface handling layer (viridian) and relates to guest memory page management.

An attacker controlling a guest machine can cause a crash of the Xen hypervisor (host crash), resulting in denial of service for all virtual machines running on that host. Depending on the environment and execution context, further impact on system integrity and confidentiality cannot be excluded (as reflected in the CVSS vector C:H/I:H/A:H).

Apply patches available from the vendor according to references — see advisory XSA-472 at https://xenbits.xenproject.org/xsa/advisory-472.html. As a temporary workaround, disabling viridian support (Hyper-V enlightenments) for guests can be considered if it is not required.

Xen hypervisor — versions indicated in vendor references (advisory XSA-472 available at xenbits.xenproject.org). The issue affects configurations with viridian interface support (Hyper-V enlightenments) enabled for guests.