The Xen hypervisor contains a defect in its VMEntry validation logic that rejects a legitimate combination of CPU states. When a #DB debug exception is intercepted while single‑stepping is active and the STI/MovSS block is in effect—optionally with branch tracing enabled—the hypervisor triggers a fatal VMEntry failure that terminates the guest. The fault does not grant code execution; it only causes the guest to crash, resulting in loss of service for that virtual machine.

The vulnerability applies to all Xen hypervisor releases that have not yet incorporated a fix for the XSA‑308 logic. It can be triggered by both paravirtualized and hardware virtual machine guests, but the bug is avoided by running only PV guests, or by running HVM guests exclusively on AMD or Hygon processors, which do not exercise the problematic code path.

The CVSS score of 5.5 signals a moderate severity level. The EPSS score of less than 1% indicates a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation would likely require an attacker who can influence code execution within a guest to induce the precise state combination that triggers the failure, making it a nontrivial attack vector.