Database/Kernel, userspace & hypervisor
Xen: synthetic timer delivery assumes the SIM page is mapped, letting a guest crash the host
Impact
When a viridian synthetic timer message has to be delivered, Xen assumes the guest's SIM page is mapped. A guest that arranges for it not to be triggers a NULL pointer dereference in the hypervisor and crashes the host. As with the other XSA-472 issues the consequence on a GPU node is the loss of every tenant on the machine, which is expensive to re-schedule when each VM holds pinned accelerators and fabric endpoints. This is a separate code path from CVE-2025-27466 and is fixed by its own change in the same advisory.
Who can reach it
A local administrator inside any HVM guest with viridian enlightenments enabled. No authentication to the host is required.
What to do
Install the XSA-472 hypervisor patches or the vendor Xen update that includes them, then reboot each host after draining or live-migrating its guests. Disabling viridian enlightenments for affected guests avoids the path until the window can be scheduled.
References
Related entries
- Xen: race in viridian reference TSC page mapping frees a page still live in the guest p2mCVE-2025-58143 · Xen viridian enlightenments (reference TSC page mapping race, p2m)Critical
- Linux kernel libceph: unchecked length from the wire allows out-of-bounds writes in cephx authCVE-2025-68284 · Linux kernel libceph (handle_auth_session_key length validation)Critical
- Linux kernel libceph: use-after-free racing a monmap or osdmap update during CephFS mountCVE-2025-68285 · Linux kernel libceph (have_mon_and_osd_map monmap/osdmap locking)Critical
- Linux kernel crypto: AEAD algorithms using cra_reqsize get an uninitialized reqsize, corrupting memoryCVE-2025-68726 · Linux kernel crypto AEAD framework (request size initialization)Critical
- Linux kernel qla2xxx: wrong free of a pooled purex item on the PURLS error path corrupts memoryCVE-2025-68741 · Linux kernel qla2xxx (purex item freed with kfree instead of qla24xx_free_purex_item)Critical
- Linux kernel qla2xxx: commands leak after chip reset, and racing unmaps hit a BUG_ONCVE-2025-68745 · Linux kernel qla2xxx (command cleanup after chip reset)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.