CVE-2025-58144
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
11/09/2025
Last modified:
04/11/2025
Description
[This CNA information record relates to multiple CVEs; the<br />
text explains which aspects/vulnerabilities correspond to which CVE.]<br />
<br />
There are two issues related to the mapping of pages belonging to other<br />
domains: For one, an assertion is wrong there, where the case actually<br />
needs handling. A NULL pointer de-reference could result on a release<br />
build. This is CVE-2025-58144.<br />
<br />
And then the P2M lock isn&#39;t held until a page reference was actually<br />
obtained (or the attempt to do so has failed). Otherwise the page can<br />
not only change type, but even ownership in between, thus allowing<br />
domain boundaries to be violated. This is CVE-2025-58145.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:xen:xen:*:*:*:*:*:*:arm:* | 4.12.0 (including) | 4.17.0 (excluding) |
To consult the complete list of CPE names with products and versions, see this page