CVE-2025-27466criticalCWE-395

CVE-2025-27466: critical vulnerability in Xen

Mutiple vulnerabilities in the Viridian interface

Published · Updated

Follow this CVE+ Monitor Xen+ Monitor xen

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.5%
In short

A NULL pointer dereference vulnerability in Xen's Viridian hypervisor code allows a guest to crash the hypervisor by triggering an error when updating the reference TSC (Time Stamp Counter) area, potentially causing denial of service.

Technical detail

CVE-2025-27466 involves a NULL pointer dereference in the viridian reference TSC area update routine. The attack vector requires guest-level code execution within a Hyper-V-enabled guest; the vulnerability occurs when the hypervisor attempts to dereference a NULL pointer during TSC page handling. Impact is denial of service via hypervisor crash.

Summary generated and translated by AI from the official description.
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Xen · Xen
Related CVEs — Xen

In the same product, most dangerous first.

CVE-2024-31142HIGHx86: Incorrect logic for BTC/SRSO mitigationsEPSS 17.4%CVE-2024-2201MEDIUMCVE-2024-2201EPSS 8.8%CVE-2023-46842MEDIUMx86 HVM hypercalls may trigger Xen bug checkEPSS 8.5%CVE-2024-2193MEDIUMSpeculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.EPSS 1.3%CVE-2025-1713HIGHdeadlock potential with VT-d and legacy PCI device pass-throughEPSS 0.9%CVE-2023-46839MEDIUMpci: phantom functions assigned to incorrect contextsEPSS 0.8%