The Linux kernel contains a buffer overflow in drivers/xen/sys-hypervisor.c. A non‑NULL‑terminated string returned by HYPERVISOR_xen_version causes the sprintf in buildid_show to read past the intended data and copy until it finds a null byte, leading to a memory corruption. This flaw enables an attacker to overwrite kernel memory controls, potentially allowing arbitrary code execution with kernel privileges.

All Linux kernel installations that include the Xen hypervisor driver are affected, regardless of vendor distribution. The vulnerability is present in the kernel source for any distribution that has not yet patched the sys-hypervisor.c change.

The CVSS score is not provided, but a buffer overflow in kernel space is typically high‑severity. EPSS is unavailable, and the vulnerability is not listed in the CISA KEV catalog at this time. An attacker would need the ability to invoke the Xen hypervisor interface, which may be reachable remotely from a guest or locally via privileged code. Successful exploitation would likely result in a hard kernel crash or privilege escalation to the kernel level.