High (8.2). EPSS 1.1% chance of exploitation in the next 30 days.
Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.
Severity
CVSS 3.0
8.2 high
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS
1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)