The vulnerability arises from a race condition when the Xen hypervisor switches a grant table from version 2 back to version 1. While the table lock is temporarily dropped, an attacker can exploit the assumption that grant table properties remain unchanged. If successful, the attacker might manipulate shared memory permissions or access stale grant references, leading to potential integrity violations or denial of service in a virtualized environment.

This issue affects Xen hypervisor implementations. Specific impacted product is Xen: Xen. No official product or version list is provided by the CNA; therefore the scope covers all Xen hypervisor releases that support grant table version switching, until an official fix is released.

The CVSS base score of 6.5 indicates a medium severity vulnerability. The EPSS score is below 1%, indicating a low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The attack is likely limited to a privileged guest or malicious hypervisor, requiring an attacker to hold a valid graphical or memory sharing context when the version switch occurs. Due to the race condition, exploitation would require precise timing or repeated attempts, making it more complex than a straightforward remote attack.