## This update for xen fixes the following issues: Security fixes: * CVE-2025-58150: Fixed buffer overrun with shadow paging and tracing (XSA-477) (bsc#1256745) * CVE-2026-23553: Fixed incomplete IBPB for vCPU isolation (XSA-479) (bsc#1256747) * CVE-2025-58149: Fixed incorrect removal od permissions on PCI device unplug allow PV guests to access memory of devices no longer assigned to it (XSA-476) (bsc#1252692) * CVE-2025-27466, CVE-2025-58142, CVE-2025-58143: Fixed multiple vulnerabilities in the Viridian interface (XSA-472) (bsc#1248807) Other fixes: * Fixed virtxend service restart. Caused by a failure to start xenstored (bsc#1254180)
* bsc#1248807
* bsc#1252692
* bsc#1254180
* bsc#1256745
* bsc#1256747
Cross-
* CVE-2025-27466
* CVE-2025-58142
* CVE-2025-58143
* CVE-2025-58149
* CVE-2025-58150
* CVE-2026-23553
CVSS scores:
* CVE-2025-27466 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
* CVE-2025-27466 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-58142 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
* CVE-2025-58142 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-58143 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-58143 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-58149 ( SUSE ): 4.3
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Get the latest Linux and open source security news straight to your inbox.