xen (SUSE:Linux Enterprise Module for Basesystem 15 SP7) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Basesystem 15 SP7 package xen, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (18)

• CVE-2025-27466 — CVSS 9.8 (critical): [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are…
• CVE-2025-58143 — CVSS 9.8 (critical): [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are…
• CVE-2025-58142 — CVSS 9.8 (critical): [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are…
• CVE-2025-58150 — CVSS 8.8 (high): Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with…
• CVE-2026-42488 — CVSS 8.1 (high): Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch…
• CVE-2026-42487 — CVSS 7.9 (high): HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via…
• CVE-2026-23554 — CVSS 7.8 (high): The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple…
• CVE-2025-58147 — CVSS 7.5 (high): [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some…
• CVE-2025-58148 — CVSS 7.5 (high): [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some…
• CVE-2025-58149 — CVSS 7.5 (high): When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have…
• CVE-2026-23555 — CVSS 7.1 (high): Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a…
• CVE-2026-42490 — CVSS 6.5 (medium): [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create…
• CVE-2024-36357 — CVSS 5.6 (medium): A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in…
• CVE-2024-36350 — CVSS 5.6 (medium): A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting…
• CVE-2024-28956 — CVSS 5.6 (medium): Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow…
• CVE-2026-42489 — CVSS 5.3 (medium): [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create…
• CVE-2025-27465 — CVSS 4.3 (medium): Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an…
• CVE-2026-23553 — CVSS 2.9 (low): In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run…