The vulnerability lies in the EVTCHNOP_expand_array hypercall of the Xen hypervisor, which checks whether FIFO event channels are enabled without acquiring the correct lock. When a guest simultaneously triggers EVTCHNOP_reset, the race condition leads to a NULL pointer dereference, causing the hypervisor to crash and resulting in a denial‑of‑service. This weakness is an improper synchronization defect (CWE‑362).

The issue affects the Xen hypervisor platform. No specific versions are listed in the advisory, so all deployments of Xen that use the EVTCHNOP interface are potentially vulnerable.

The CVSS score of 7.3 indicates high severity, while an EPSS score below 1 % suggests a low probability of exploitation at present. The vulnerability is not tracked in the CISA KEV catalog. An attacker would need to send crafted hypercalls from a privileged guest, making the attack vector largely internal to the virtualized environment; however, a compromised guest could trigger the race and crash the hypervisor. The lack of a known workaround and the kernel‑level nature of the defect imply a moderate‑to‑high risk for environments that run untrusted guests.