The vulnerability originates from an integer underflow that occurs during the calculation performed when a guest issues the GNTTABOP_cache_flush operation on a Xen hypervisor. The underflow leads to an unbounded loop that can run for an excessively long time, eventually causing the hypervisor to crash. The result is a denial of service at the host level, affecting all guests running on the compromised Xen hypervisor. The weakness is an improper handling of arithmetic boundaries, which does not provide direct code execution or data modification but can still alter the hypervisor’s state.

Xen hypervisors that support 64‑bit Arm guests and have not yet applied the XSA‑437 patch are affected. Any host running a 64‑bit Arm build of Xen and executing GNTTABOP_cache_flush operations in guests is susceptible, regardless of specific Xen version numbers as long as the fix has not been incorporated.

The CVSS score of 7.5 indicates a medium‑to‑high severity, while an EPSS score of less than 1% implies a low but nonzero likelihood of exploitation. The CVE is not listed in the CISA KEV catalog, but the vulnerability can be triggered by any guest capable of issuing the GNTTABOP_cache_flush command on a grant table entry, so the attack vector is likely an internal guest environment. Because the flaw leads to an unbounded loop that ultimately crashes the hypervisor, it poses a high‑severity denial‑of‑service risk for affected deployments. The lack of a publicly available exploit, combined with the severity of a hypervisor crash, suggests that the risk remains significant yet limited to environments that allow the required operation.