The Linux kernel contains a buffer overflow in drivers/xen/sys-hypervisor.c. The function handling the Xen hypervisor interface returns a build ID string that is not NUL terminated. A subsequent sprintf in buildid_show copies data until it finds a null byte, which can read past the intended buffer and overwrite memory. This overflow can cause kernel memory corruption and potentially a crash or system instability. This issue corresponds to CWE-170 (Improper Null Termination) and CWE-787 (Out-of-Bounds Write).

Affected systems include all Linux kernel installations that contain the Xen hypervisor driver and have not yet applied the patch that replaces the sprintf with a memcpy. The vulnerability may exist in any distribution that ships the unmodified kernel source for drivers/xen/sys-hypervisor.c; no specific version range is provided in the CNA data. Kernel builds that include the updated code are immune.

The CVSS score of 7.8 indicates high severity while the EPSS score of <1% and absence from the CISA KEV indicate that exploitation on the Internet is unlikely at present. The likely attack vector is through the Xen hypervisor interface, which an attacker may access from a privileged guest or by running code with hypervisor privileges. Based on the description, it is inferred that an attacker must be able to trigger the HYPERVISOR_xen_version hypercall to cause the overflow. If achieved, the attacker could gain arbitrary kernel memory corruption, elevating privileges or inducing denial of service. The overall risk is therefore moderate to high with low likelihood of exploitation.