During a Xenstore live update the state record for a watch with a specified watch depth is written with two bytes missing. This causes an inconsistent state when the record is later read in the new Xenstore, leading to a crash or corrupted data. The crash disrupts Xenstore services, which can halt guest operations or compromise host stability, effectively denying service to any running virtual machines or host processes that rely on Xenstore.

Vendors: Xen, Product: Xen. No specific version information is provided in the advisory, so all Xen deployments that perform Xenstore live updates should consider this vulnerability.

The adversary would need to trigger a live update of Xenstore, which is typically performed by the host or an administrator. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates medium severity, but the crash of Xenstore still results in a denial of service to guests and host processes. Because no publicly known exploit exists, the likelihood is uncertain, yet the potential impact warrants attention. The fact that disabling live updates or switching to oxenstored avoids the crash provides a clear mitigation path.