The Xen hypervisor’s legacy shadow paging mechanism, retained for legacy guests, can consume excessive host resources, leading to prolonged preemption, guest crashes, or denial of service. This weakness is classified as CWE‑400, Excessive Resource Consumption, and hinges on the hypervisor’s choice to keep obsolete support active at user’s risk.

Any Xen hypervisor installation that has the shadow paging feature enabled is vulnerable. Both HVM and PVH guests running with shadow paging can trigger the issue; PV guests lack a vendor workaround and will crash if the capability is present. The vulnerability applies to all Xen versions where the feature is enabled, with no specific version range provided.

The CVSS score of 7.5 indicates a high severity impact, while an EPSS score of less than 1 % signals a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can control a guest may attempt to induce heavy preemption or memory pressure to exhaust host resources and cause a denial of service. Exploitation is largely dependent on configuration: disabling the feature or moving guests to Hardware Assisted Paging mitigates the risk.