The vulnerability exists in the Linux kernel Xen pvcalls frontend. A backend can supply a response with a request identifier that exceeds the allowed bounds. The frontend copies the identifier directly into a signed int and uses it to index a fixed-size array for a memcpy and a store with no bounds checking, leading to an out‑of‑bounds write that corrupts kernel memory. This mistake allows a malicious or buggy backend to alter arbitrary kernel data, potentially causing a denial of service or enabling further privilege escalation.

All Linux kernel installations that use the Xen paravirtualization (pvcalls) frontend and are built before the kernel commit that introduces the bound check (c/d1297a9e2fd6ce08678b370d41bc980ca798f809). Such systems normally run Xen paravirtualized networking or other pvbackend interfaces that depend on pvcalls.

Because the flaw permits a kernel write outside the allocated array, the risk is high, as indicated by the CVSS score of 8.8, should an attacker control the backend or cause a buggy response. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to send a crafted pvcalls response to the vulnerable frontend. The kernel will log once and disable trust in the backend, but the initial out‑of‑bounds write may already compromise the system before this defensive action occurs.