VDB
ALPINE-CVE-2025-58148
ALPINE-CVE-2025-58148
PUBLISHED
CVSS 7.5 HIGH
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.23 | xen | 4.17.0-r5, 4.17.0-r4, 4.17.0-r3 |
| Alpine:v3.20 | xen | 4.2.1-r7, 4.18.5-r2, 0 |
| Alpine:v3.19 | xen | 4.2.0-r0, 4.0.1-r1, 4.0.1-r2 |
| Alpine:v3.24 | xen | 4.15.0 |
| Alpine:v3.21 | xen | 4.1.2-r5, 4.10.1-r1, 4.1.2-r4 |
| Alpine:v3.22 | xen | 4.1.2-r11, 4.1.2-r10, 4.1.1-r2 |
Timeline
- Oct 31, 2025 CVE Published
- Apr 30, 2026 Distribution Patch
- Jul 8, 2026 CVE Updated