Xen Hypervisor CVE-2025-58146 XSA-474

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:03 vuln.today

DescriptionCVE.org

Alpine Linux: xen fixed in 0

AnalysisAI

Xen Hypervisor on Alpine Linux is affected by a security vulnerability tracked as XSA-474 (CVE-2025-58146). The available intelligence is critically sparse: no CVSS vector, no CWE classification, and no descriptive detail about the vulnerability class or impact have been provided in the source data. The Alpine Linux vendor has acknowledged a fix exists, but the reported fix version ('0') is anomalous and likely represents a data artifact or placeholder rather than a valid package version. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Xen is an open-source Type-1 (bare-metal) hypervisor widely used in cloud infrastructure, virtualization platforms, and security-sensitive deployments. XSA (Xen Security Advisory) 474 is issued by the Xen Project security team and cross-referenced as CVE-2025-58146. The affected package is 'xen' as distributed by Alpine Linux. No CWE root cause classification is available in the provided data, making it impossible to confirm whether this is a memory safety issue, privilege escalation, information disclosure, or another vulnerability class. CPE data was not supplied, so exact affected version ranges cannot be confirmed from this dataset alone.

Affected ProductsAI

The affected product is the Xen hypervisor package ('xen') as distributed by Alpine Linux. The reported fix version in the source data is listed as '0', which is anomalous and likely a data quality artifact rather than a valid Alpine package version. No CPE strings were provided. Specific Alpine Linux branch versions (e.g., edge, v3.x) affected are not confirmed from this dataset. Consumers should consult the Alpine Linux security tracker and the official Xen Project advisory for XSA-474 directly to obtain accurate version range information.

RemediationAI

Update the Xen package on Alpine Linux per the vendor's security advisory. The source data indicates a fix has been released by Alpine Linux, but the specific fixed version ('0') is not a valid actionable version string - administrators should query the Alpine Linux package tracker or security errata for the correct patched version number applicable to their Alpine branch. As a compensating control pending verification, organizations running Xen in security-sensitive environments should restrict management plane access, minimize the number of privileged domains (dom0), and enforce strict network segmentation on Xen host interfaces. Without knowing the vulnerability class, no further targeted mitigations can be responsibly recommended. Do not rely on the version '0' as a remediation target.