Domctl operations in Xen use a system‑wide lock to serialize sensitive actions such as creating or destroying guests. The admission control for this lock does not enforce fairness, allowing a single domain to repeatedly acquire and hold the lock. An attacker controlling such a domain can monopolise the lock, starving other domains and the control domain itself of critical operations, effectively causing a denial of service.

The vulnerability affects the Xen hypervisor product across all versions where the described locking mechanism is present. No specific version ranges are listed in the advisory, so any deployment of Xen with domctl operations may be impacted.

The CVSS score of 5.3 indicates medium severity; EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector would be local to the hypervisor; a malicious domain or administrator with control over domctl can abuse the lock. Because no patch or workaround exists, the primary mitigation is to guard the hypervisor heavily and monitor for updates until a fix is released.