A Xen guest can write the value zero to the xenbus key "multi-queue-num-queues". The backend connect function in xen‑netback only verifies that the requested number of queues does not exceed the maximum allowed; it does not reject a zero value. When a guest supplies zero, the function attempts a memory allocation of size zero, which triggers a WARN_ON_ONCE in the memory allocator. On systems with kernel.panic_on_warn set to enabled, this warning escalates to a kernel panic, causing the host to crash. The flaw represents an input validation weakness and a failure to guard against zero‑sized allocations (CWE‑1284), but it does not compromise confidentiality or integrity.

All Linux kernel installations that provide the xen‑netback backend for Xen, regardless of distribution, are affected. The advisory does not list specific kernel versions, so any host kernel implementing xen‑netback without the zero‑value guard is at risk.

The vulnerability lacks a published CVSS score and the EPSS score is 0.00024, indicating a very low exploitation probability, yet it is not included in the CISA KEV catalog. Exploitation requires a Xen guest that can write to xenbus keys, an ability normally confined to privileged or misconfigured virtual machines. The attack does not require external network access, but a malicious or buggy guest can trigger a host crash by setting the zero value. Given that denial of service is the primary impact and the host crash occurs only when panic_on_warn is enabled, the risk is considered moderate to high for environments that rely on xen‑netback and have this kernel sysctl active.