CVE-2025-58143

During the mapping of the Reference TSC Page by Xen's viridian code, a race condition (CWE-366) occurs — a guest can trigger a sequence of operations at the right moment that causes Xen to free a memory page before it is removed from the p2m table (guest physical to machine page tables). As a result, the p2m tables retain an entry pointing to an already freed machine page. Such a situation can lead to unauthorized memory access or its reuse in an uncontrolled manner.

An attacker controlling a guest system can compromise the confidentiality, integrity, or availability of the host and other virtual machines — potentially enabling privilege escalation, virtual machine escape, or hypervisor destabilization.

Apply patches available from the vendor according to the references — see advisory XSA-472 at https://xenbits.xenproject.org/xsa/advisory-472.html

Xen hypervisor — versions indicated in vendor references (advisory XSA-472 on xenbits.xenproject.org)