Executive brief
A vulnerability exists in the Xen hypervisor, which is software used to run multiple virtual machines on a single physical server. An attacker controlling a virtual machine could exploit a flaw in how the system handles specific timer functions to crash the entire physical host server. This results in a total denial of service, causing all other virtual machines on that server to stop functioning.
Technical details
A division-by-zero vulnerability exists in the Xen hypervisor's handling of Viridian STIMERs (Synthetic Timers). The flaw is located in the logic for periodic timers where a user-controlled divisor value is not properly validated before use in a division operation. An unprivileged HVM guest with Viridian STIMERs enabled can trigger a #DE (Divide Error) fault by setting the divisor to zero. Because this fault occurs within the hypervisor context, it leads to a crash of the entire host (Denial of Service). The vulnerability affects Xen versions 4.13 and later; versions 4.12 and earlier are unaffected. A patch is available from the Xen Project (XSA-504).
Affected products
- Xen Project Xen 4.13 onwards
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched