The vulnerability stems from Xen's context switch logic skipping an IBPB when a virtual CPU returns to a physical processor it previously occupied. This omission means the guest kernel cannot fully purge the Branch Target Buffer state between tasks on the same virtual CPU, creating a speculative execution leakage channel. Based on the description, it is inferred that a malicious process running in one user task could exploit leftover BTB state to read data generated by another task that previously ran on the same virtual CPU.

All Xen hypervisors operating on Intel x86 architectures are affected, as the flaw resides in Xen's default IBPB handling. The advisory indicates that the workaround of specifying spec-ctrl=ibpb-entry=hvm,ibpb-entry=pv on the Xen command line activates the SRSO mitigation on non‑SRSO‑vulnerable hardware, although this introduces significant performance overhead.

The CVSS score of 2.9 denotes moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. The attack requires a guest with sufficient privileges to run multiple tasks on the same virtual CPU and to perform speculative execution reading, but no additional host privileges are needed. Consequently, the threat to confidentiality is measurable yet limited, with exploitation unlikely unless an attacker can orchestrate tasks within a compromised guest.