CVE-2025-58148: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-58148 is a security vulnerability discovered in Xen's handling of Viridian hypercalls. The vulnerability was publicly disclosed on October 21, 2025, as part of XSA-475. It affects Xen versions 4.15 and newer, specifically impacting x86 HVM guests with Viridian enabled (Xen Advisory).

The vulnerability stems from boundary checking bugs in Viridian hypercalls that process vCPU ID mask inputs. Specifically, hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds and operate on a wild vCPU pointer. This occurs during the processing of vCPU ID mask inputs in any of the three available formats (Xen Advisory, Ubuntu CVE).

A malicious or buggy guest can exploit this vulnerability to cause Denial of Service (DoS) affecting the entire host, information leaks, or elevation of privilege. The vulnerability has been assigned a CVSS 3.1 Base Score of 7.5 (High), indicating significant potential impact (Xen Advisory).

The primary mitigation is to not enable Viridian for guest VMs. For a permanent fix, system administrators should apply the security patches provided in XSA-475. These patches are available for Xen versions 4.17.x through 4.20.x. Citrix has also released updates for XenServer 8.4 through both Early Access and Normal update channels (Citrix Support, Xen Advisory).