A race condition exists between the cleanup of a Xen hypervisor guest’s vNUMA configuration during domain destruction and the retrieval of that configuration by a device model controlling the guest. Because the cleanup is not synchronized, an attacker can still access the configuration data after the domain has begun shutting down, potentially exposing sensitive deployment information and infringing confidentiality. The underlying flaw is an example of a classic race condition (CWE‑362).

The vulnerability affects the Xen hypervisor when vNUMA is enabled for HVM guests. Xen systems that run only PV or PVH guests on x86 are not affected, and not enabling vNUMA for HVM guests in the configuration also removes the risk. No specific version identifiers are provided, so all Xen deployments with active vNUMA on HVM guests should be considered vulnerable.

The CVSS score of 6.5 indicates a medium severity threat, and the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, further implying that no widespread, active exploitation has been observed. The likely attack vector is that a local or privileged attacker, during the domain termination process, can observe the race and read the vNUMA configuration before it is cleaned up. Because the effect is mainly information disclosure, the overall risk is moderate, though it should be addressed promptly for exposed environments.