CVE-2025-58150

Name	CVE-2025-58150
Description	Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4818-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xen (PTS)	bookworm	4.17.5+72-g01140da4e8-1	vulnerable
	bookworm (security)	4.17.7-0+deb12u1	fixed
	trixie (security), trixie	4.20.3+127-gc42374a105-0+deb13u1	fixed
	forky, sid	4.20.3+127-gc42374a105-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
xen	source	bullseye	(unfixed)	end-of-life
xen	source	bookworm	4.17.7-0+deb12u1		DLA-4818-1
xen	source	trixie	4.20.2+37-g61ff35323e-0+deb13u1
xen	source	(unstable)	4.20.2+37-g61ff35323e-1

[bullseye] - xen <end-of-life> (EOLed in Bullseye)
https://xenbits.xen.org/xsa/advisory-477.html