NULL pointer dereference in Xen
CVE-2025-58144
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144. And then the P2M lock isn't held until a page reference was actually obtained (or the attempt to do so has failed). Otherwise the page can not only change type, but even ownership in between, thus allowing domain boundaries to be violated. This is CVE-2025-58145.
EPSS: 0.004 (34.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Xen — versions consult Xen advisory XSA-473
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-58144?
- CVE-2025-58144 is a high-severity vulnerability in Xen, classified under NULL Pointer Dereference. CVSS score: 7.5/10. Published 2025-09-11.
- How severe is CVE-2025-58144?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-58144 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.