The xen/privcmd driver can execute arbitrary hypercalls from user‑space processes. Normally access is restricted to root and the hypervisor blocks calls that affect other domains. When a guest boots with secure boot enabled, a root process inside that guest can use the driver to modify kernel memory, effectively bypassing the secure boot protection. This flaw only matters for an unprivileged domU that uses the privcmd driver as the device model for another guest, because the hypercalls then target that second guest.

Affected systems are Linux kernels that include the xen/privcmd module, specifically hosts running XSA‑482–affected code. Version information is not explicitly listed, so any kernel that contains this driver without the lock‑down is vulnerable. The flaw is present in the Linux kernel, as indicated by the provided CPE string.

The vulnerability scores CVSS 8.2 and has an EPSS probability below 1 %. It is not listed in the CISA KEV catalog, but its high severity and the ability to compromise the hypervisor or other guests make it a significant risk. The likely attack vector is a local or privileged process inside an unprivileged domU that can issue hypercalls after secure boot is enabled; this is inferred from the description. Exploitation would allow unauthorized modification of kernel or guest memory, yielding privilege escalation and possible remote code execution at the host or second‑guest level.