When a Xen domain is destroyed, oxenstored normally cleans up node data but leaves usage counts intact. The leaked counts are carried over to the next domain that receives the same domain ID, causing that domain to appear over quota after creating fewer nodes. This limits legitimate use of storage and is classified as a CWE-281 flaw, representing incomplete cleanup of critical internal state.

The vulnerability affects Xen’s oxenstored storage backend. No specific version is listed, so any deployment of oxenstored at the time of the advisory may be impacted. Systems that recycle domain IDs are particularly susceptible as the flaw manifests during domain teardown and subsequent ID reuse.

The CVSS score of 9.4 places the vulnerability in the high severity range. The EPSS score of < 1% indicates a very low probability of exploitation, and it is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker would need privileged or local access to create and destroy domains to manipulate domain ID reuse. If achieved, the attacker can force legitimate domains to hit storage quotas prematurely, leading to service interruption.