The vulnerability arises because the Intel EPT paging code defers flushing of cached EPT entries until the p2m lock is released, while freeing of paging structures occurs immediately. This mismatch can leave freed memory pages in a stale cached state, and the stale entries may reference memory ranges that are no longer owned by the victim guest. A malicious guest can trigger this behavior to read or potentially write to host memory outside of its designated area, effectively creating a use‑after‑free condition (CWE‑367).

The flaw targets Xen hypervisor installations running on x86 hardware, as indicated by the associated CPE string. No specific Xen version numbers are provided in the CNA data, so all Xen deployments on x86 should be treated as potentially vulnerable until a vendor patch is released.

The CVSS score of 7.8 indicates high severity, while the EPSS metric of <1 % suggests the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation would most likely originate from code running inside a guest that forces the deferred flush while freeing paging structures. Successful exploitation could compromise host confidentiality, integrity, or availability if the attacker can read or overwrite shared memory.