The vulnerability lies in the domctl operation lock mechanism used by the Xen hypervisor to coordinate guest creation and management. Because the lock acquisition does not enforce fairness and, when XSM/Flask is enabled, the lock is taken before permission checks for certain operations, an attacker with control of the control domain or a domain with access to domctl can acquire the lock ahead of the security policy. This allows the attacker to perform privileged operations—such as starting, stopping, or modifying other guests—without proper authorization, effectively escalating privileges and potentially causing disruption.

Xen hypervisor hosts that run domctl operations, particularly those enabled for XSM/Flask security monitoring. The issue is relevant to any Xen installation where the hypervisor’s domctl lock is used without fairness, including standard Xen configurations that manage virtual machines.

The CVSS score of 6.5 indicates a medium severity risk. The EPSS score is not available, so the current predicted exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need local or privileged access to the control domain and to execute domctl commands; with XSM/Flask enabled, the lack of fairness in lock acquisition can allow the attacker to preempt permission checks and gain unauthorized control over guest VMs.