Alpine Linux Xen CVE-2025-58149

The provided description ('Alpine Linux: xen fixed in 4.20.1-r2') contains no technical prerequisites; the concrete condition is running an affected Xen 4.20.x build earlier than 4.20.1-r2 (Alpine packaging). Based on CWE-672 and XSA-476, exploitation realistically requires the attacker to control or compromise a guest domain on the Xen host so they can trigger the use-after-expiration/release condition and read leaked memory - this guest-execution requirement is the primary limiting factor and is not reflected in the NVD AV:N/PR:N vector. Impact is limited to confidentiality (information disclosure); no integrity or availability effect is indicated. Verify exact affected Xen versions and whether any non-default configuration is required against xenbits XSA-476.

Signals are mixed and lean toward moderate, patch-when-able priority rather than emergency. The NVD CVSS 3.1 base score is 7.5 (High) from vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - pure confidentiality impact (CWE-672, operation on a resource after expiration/release), consistent with the 'Information Disclosure' tag. EPSS is low at 0.40% (34th percentile), there is no CISA KEV listing, and no public exploit is identified, so there is no evidence of active or imminent mass exploitation. A key conflict must be verified: NVD encodes AV:N/PR:N (remote, unauthenticated), but Xen hypervisor information-disclosure flaws (XSA-476) are typically triggered by a malicious or compromised guest VM against the host - i.e. local/guest-privileged, not network-unauthenticated. This AV:N/PR:N labeling may reflect downstream Alpine scoring rather than the true attack surface; verify against xenbits XSA-476 before treating this as remotely reachable. Net: a genuine confidentiality issue worth patching on multi-tenant/virtualization hosts, but the low EPSS, absent KEV, and absent POC argue against crisis-level urgency.

An attacker who controls a guest VM on an unpatched Xen 4.20 host (pre-4.20.1-r2 on Alpine) triggers an operation on a freed or expired hypervisor resource and reads memory contents belonging to the host or another guest, disclosing sensitive data such as cryptographic material or other tenants' data. No public proof-of-concept is available, and the low attack complexity (AC:L) means a single reliable trigger would suffice, though successful exploitation realistically presupposes the ability to execute code inside a guest.