Xen PV Drivers CVE-2025-27463

Apply the fixed Xen Windows PV driver packages published under Xen Security Advisory XSA-468 (https://xenbits.xen.org/xsa/advisory-468.html), which add proper security descriptors restricting the XenIface, XenCons, and XenBus device interfaces to privileged callers; exact patched version strings are not provided in this intelligence set and must be read from the advisory. No vendor-released patch version is independently confirmed here beyond the advisory reference. As a compensating control until drivers are updated, restrict interactive and remote logon on affected Windows guests to trusted administrators only (this defect requires a local user session, so limiting who can run code in the guest directly reduces exposure), and where operationally acceptable tighten the driver device object ACLs or remove/disable unused PV facilities - with the trade-off that disabling PV management interfaces can degrade guest tooling, monitoring, and performance features. Prioritize patching guests that permit untrusted or multi-tenant local users.