The Xen Page Table Isolation (XPTI) feature copies 64‑bit paravirtual guest page‑table entries from the guest’s selected root tables to the Xen‑chosen tables used by the hardware. Under configurations where the hypervisor is allowed to address more than 5 TiB of memory, the direct map used to read the guest’s root tables may not cover the full address space. This leads to an incomplete or erroneous copy of page‑table entries, which can expose guest memory to the host and potentially allow an attacker to gain unauthorized control or read privileged data. The weakness is an example of improper access control and information exposure.

The vulnerability is present in the Xen hypervisor when 64‑bit paravirtual guests are scheduled on a host that has been configured with a memory amount exceeding 5 TiB (CONFIG_BIGMEM=y). It applies to all Xen releases that support that configuration, as no specific version has been identified. Reducing the hypervisor memory to 5 TiB or lower or avoiding 64‑bit PV guests eliminates the problematic code path.

The CVSS score is 8.8, indicating high severity, and the EPSS score is <1%. The vulnerability is not listed in CISA’s KEV catalog, indicating that there is no known active exploitation. However, an administrator who can control the hypervisor or modify its memory allocation could trigger the issue by launching 64‑bit PV guests on a large‑memory host. The resulting host‑level privilege escalation or data leakage would compromise the entire virtualized environment. The risk remains contingent on the hypervisor’s configuration and the presence of 64‑bit paravirtual workloads.