A Xen guest can write the value zero to the xenbus key "multi-queue-num-queues". The backend connect function only checks that the requested number of queues does not exceed the maximum allowed, but it does not reject a zero value. This results in a memory allocation of size zero that triggers a WARN_ON_ONCE in the memory allocator. On systems where panic_on_warn is enabled, this warning escalates to a kernel panic, causing a guest‑to‑host denial of service. The vulnerability is an input validation weakness (CWE‑20) that allows a guest to influence kernel memory allocation parameters, leading to host downtime without compromising confidentiality or integrity.

All Linux kernel versions running Xen, as the vulnerability is present in the xen‑netback backend code for any distribution that includes the affected kernel sources. No specific version numbers are listed in the CNA data, so the advisory applies broadly to any host kernel that implements xen‑netback without the zero‑value guard.

The CVSS score is not provided and the EPSS score is unavailable, but the vulnerability is not currently listed in the CISA KEV catalog. The attack requires a Xen guest with the ability to write to xenbus keys, which is usually confined to privileged or misconfigured virtual machines. The exploit does not require network exposure to the host and pivots entirely within the virtualized environment; however, if the guest is user‑controlled, denial of service can be actively triggered. Due to the lack of public exploitation data, the risk is considered moderate to high for environments where panic_on_warn is enabled and guests can manipulate xenbus.