The vulnerability occurs when the Xen grant table undergoes a sequence of version changes (v2 to v1 to v2). During the first downgrade, status pages are freed. After the subsequent upgrade, these pages are reallocated, causing the addresses of the status pages to change. This race condition leads to stale, dangling pointers in the status array, which can result in memory corruption and potential denial‑of‑service or uncontrolled execution within the hypervisor. The weakness is a classic race condition (CWE‑362).

The flaw affects the Xen hypervisor shipped by the Xen Project. No specific version numbers were disclosed in the advisory, so all recent Xen distributions that implement the grant‑table versioning scheme may be vulnerable until a patch is released.

The CVSS score is 8.8, and the EPSS score indicates a very low but non‑zero exploitation probability (<1%). The vulnerability resides in privileged hypervisor code, so any successful exploitation would grant host control. The likely attack vector is a guest that can trigger the contested version transitions; this is inferred from the description. The attack requires a guest that can trigger the version changes, which is feasible for privileged guests or an attacker that can compromise the hypervisor’s guest configuration. While the vulnerability is not listed in CISA's KEV catalog and no public exploit is known, the race condition and dangling pointer combination warrants a high exploitation risk in environments using grant tables extensively.