Xen: guest can NULL-dereference the viridian reference TSC update path and crash the host

Impact

A guest configured with Hyper-V (viridian) enlightenments can drive the reference TSC area update path into a NULL pointer dereference in the hypervisor, crashing Xen and taking down every other guest on the host. On a GPU host this is a whole-node outage: every passed-through accelerator and every co-tenant VM on that machine dies at once, and jobs holding NVLink or InfiniBand peers lose their rank. Only denial of service is described; XSA-472 covers three distinct viridian page-handling bugs and this is the first of them. The 9.8 CVSS in NVD does not match the XSA, which describes a host crash reachable by a guest.

Who can reach it

A local administrator inside any HVM guest that has viridian enlightenments enabled. No host credentials and no network access needed; guest-level privilege is enough.

What to do

Apply the XSA-472 patches to the hypervisor, or the distribution Xen package that carries them. Xen cannot be hot-patched here in the general case: plan a maintenance window per host - live-migrate or drain the guests, install, and reboot into the new hypervisor. As an interim mitigation, running affected guests without viridian enlightenments removes the exposed code path.

References

Related entries

• Linux kernel (net/tls): The strparser kept a stale reference to an skb that TCP had already coalesced away, and theCVE-2025-38471 · Linux kernel (net/tls)Critical
• Linux kernel (net/smc): The SMC listen worker keeps touching the SMC socket after smc_listen_out() has handed it offCVE-2025-38734 · Linux kernel (net/smc)Critical
• Linux kernel (net/tls): A zero-length record already sitting on the rx_list breaks the invariant that zero-copy decryptCVE-2025-39682 · Linux kernel (net/tls)Critical
• Linux kernel SoftiWARP transmit path (siw_qp_tx, siw_tcp_sendpages byte accounting): After do_tcp_sendpages() wasCVE-2025-39758 · Linux kernel SoftiWARP transmit path (siw_qp_tx, siw_tcp_sendpages byte accounting)Critical
• Linux kernel (net/tls): When the socket buffer is too small to hold a whole record, kTLS parses early and re-parses asCVE-2025-39946 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): If the skb clone that pins the input buffer for an async decrypt cannot be allocated, kTLSCVE-2025-40176 · Linux kernel (net/tls)Critical