{
  "cveId": "CVE-2025-58150",
  "url": "https://patchblox.com/security/cve/CVE-2025-58150",
  "summary": "CVE-2025-58150 is fixed in xen on 1 platform, first by SUSE-SU-2026:0306-1, released January 27, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "xen: Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing",
  "description": "Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing.  Some of these variables are written to with guest controlled data, of guest controllable size.  That size can be larger than the variable, and bounding of the writes was missing.",
  "published": "2026-01-27T16:15:19Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss": 0.00148,
  "epssPercentile": 0.04054,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "xen",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "4.17.7-0\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2025-58150",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-58150",
      "released": "2026-01-28T16:16:12Z"
    },
    {
      "platform": "linux",
      "product": "xen",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "4.20.2\u002B37-g61ff35323e-0\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2025-58150",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-58150",
      "released": "2026-01-28T16:16:12Z"
    },
    {
      "platform": "linux",
      "product": "xen",
      "release": "Debian 14",
      "fixedVersion": "4.20.2\u002B37-g61ff35323e-1",
      "fix": "DEBIAN-CVE-2025-58150",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-58150",
      "released": "2026-01-28T16:16:12Z"
    },
    {
      "platform": "linux",
      "product": "xen",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "4.18.5_10-150600.3.37.1",
      "fix": "SUSE-SU-2026:0306-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0306-1",
      "released": "2026-01-27T16:15:19Z"
    },
    {
      "platform": "linux",
      "product": "xen",
      "release": "sles 15.7",
      "fixedVersion": "4.20.2_06-150700.3.25.1",
      "fix": "SUSE-SU-2026:0589-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0589-1",
      "released": "2026-02-20T10:05:27Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}