CVE-2023-34322 is a flaw in how Xen tears down shadow page tables for 64-bit PV guests, tracked as XSA-438 and scored 7.8 High. A guest may gain privilege or crash the host. The Xen advisory supplies patches per branch and names mitigations.
What's affected
Per XSA-438, all Xen versions from 3.2 onward are affected, and earlier versions were not inspected. Only x86 systems are affected, and only 64-bit PV guests that run in shadow paging mode. Shadow mode is used for guest migration and as a workaround for kernels that predate the L1TF fix described in XSA-273.
The advisory lists impact as privilege escalation, host-wide denial of service and information leaks, which it says cannot be ruled out. Patches are provided for xen-unstable and for the 4.17, 4.16 and 4.15 stable branches. I did not find a fixed release number in the advisory, so check your distribution or the Xen project for the release that carries the patch.
How to check if you're exposed
Start by finding your Xen version on the host:
xl info
Look at the xen_major, xen_minor and xen_extra lines. Then list the guests on the host with xl list and identify which ones are 64-bit PV. HVM and PVH guests are not affected, according to the advisory's mitigation section.
Finally, ask whether any PV guest runs in shadow mode, for example during live migration or because you enabled it as an L1TF workaround. If you use a vendor build of Xen, check the vendor's security bulletin to see whether the XSA-438 patch is included.
What to do now
- Apply the patch from XSA-438 for your branch, or install the vendor build that includes it.
- Where patching must wait, run only HVM or PVH guests, as the advisory suggests.
- Alternatively, run PV guests inside the PV shim, the second mitigation named in the advisory.
- Plan migrations of PV guests carefully, since shadow mode is used during migration.
- Record each host's Xen build and guest types in your asset list.
Why it matters
The flaw is a timing problem. When the shadow memory pool runs short, Xen may tear down shadow page tables, including the root table that the CPU is running on. A precaution exists to prevent that, but the advisory says the window it covers is not large enough.
Because the hypervisor sits under every guest, a bug here is more serious than a bug in one guest's kernel. The affected setup is narrow, which keeps most estates out of scope, but anyone still running PV guests needs to check.
The weakness classes involved are CWE-273 (Improper Check for Dropped Privileges). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
The record scores this CVE 7.8 High (local vector, low privileges). The Xen advisory gives no CVSS score, so there is no severity conflict. It names no fixed release, only patches per branch.
Quick check
Are HVM guests affected?
No. The advisory says only 64-bit PV guests in shadow mode are affected, and running only HVM or PVH guests is a listed mitigation.
Is there a fixed version?
The advisory provides patches for the 4.15, 4.16 and 4.17 branches and unstable. Check your vendor for the release that includes them.
Sources
Last reviewed: 19 October 2026.
