The vulnerability arises in the Intel EPT paging code within the Xen hypervisor, where an optimization defers flushing of cached EPT state until after the p2m lock is released. Because freeing paging structures is not deferred until the flush occurs, stale cache entries can temporarily reference memory ranges that the guest does not own. This use‑after‑free condition allows a guest to read or write memory regions it should not have access to, potentially exposing hypervisor data or data belonging to other guests. The weakness corresponds to CWE‑367 and constitutes a serious compromise of integrity and confidentiality for the host environment.

The affected product is the Xen hypervisor. No specific version information is provided, indicating that the issue may be present wherever the vulnerable EPT paging code is present. Administrators should verify their Xen version and refer to Xenbits XSA advisory 480 for details.

The CVSS score of 7.8 denotes high severity, but the EPSS score of less than 1% suggests low likelihood of exploitation at present. Because the flaw requires interaction with a guest that can manipulate its memory, the attack vector is likely local, via malicious guest code that can trigger the use‑after‑free. No evidence of exploitation exists in the KEV catalog. Once a patch is released, elevated privileges could be obtained by an attacker with guest access, making this a critical issue for systems that rely on Xen for virtualization.