DEBIAN-CVE-2025-58145
Record from OSV · Published September 11, 2025
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144. And then the P2M lock isn't held until a page reference was actually obtained (or the attempt to do so has failed). Otherwise the page can not only change type, but even ownership in between, thus allowing domain boundaries to be violated. This is CVE-2025-58145.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| xen | Debian:14 | 4.20.2+7-g1badcf5035-1 |
| xen | Debian:13 | 4.20.2+7-g1badcf5035-0+deb13u1 |
| xen | Debian:12 | 4.17.5+72-g01140da4e8-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | xen | 4.20.0+68-g35cb38b222-1, 0 |
| Debian:13 | xen | 0, 4.20.0+68-g35cb38b222-1 |
| Debian:12 | xen | 4.17.2+55-g0b56bed864-1, 4.17.2+76-ge1f9cb16e2-1, 4.17.2+76-ge1f9cb16e2-1~deb12u1 |
Timeline
- Sep 11, 2025 CVE Published
- Oct 23, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2025-58145
vulnetix vdb fixes DEBIAN-CVE-2025-58145Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2025-58145/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart