CVE-2023-46838 is a high severity (CVSS 7.5) NULL pointer dereference in Xen's Linux network backend, tracked as XSA-448. A guest can send zero-length transmit fragments and crash the host. Apply the kernel patch from your distribution, or use a userspace backend or a driver domain.
What's affected
The Xen advisory XSA-448 says systems using a Linux based network backend with kernel 4.14 and newer are vulnerable, and that earlier versions may also be affected. Other backends are not known to be vulnerable. The record's description covers the same flaw and names Linux and Fedora 38 as products.
The advisory says an unprivileged guest can cause denial of service on the host, and adds that data corruption or privilege escalation have not been ruled out. The record shows availability impact only. The weakness is CWE-476. Debian LTS and Fedora announcements in the record cover packaged fixes.
The NVD record scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness class is CWE-476 (NULL pointer dereference). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
On a Xen host, check the running kernel:
uname -r
Then check whether your guests use the in-kernel Linux netback driver or a userspace backend, and read your distribution advisory for the fixed package version. Debian, Fedora and others published announcements linked from the record.
What to do now
- Identify Xen hosts that use the Linux kernel network backend.
- Install the kernel update from your distribution that includes the XSA-448 patch, and reboot into it.
- As the advisory suggests, use a userspace PV network backend such as the QEMU based one, or run a dedicated network driver domain per guest.
- Schedule a maintenance window and migrate guests before rebooting hosts.
- Record kernel versions on each host.
Why it matters
In paravirtualised networking, the guest hands the host a series of buffers to send. The bug is that parts of zero length can add up to an empty packet, and the host code then dereferences a pointer that is not set. The kernel crashes, taking all guests on that host with it.
For shared hosting and cloud providers, that makes this a way for one tenant to disrupt others. It is a good example of why the guest should never be trusted to send well formed requests.
Try it yourself
Kernel advisories keep arriving after you have patched. This demo shows how continuous monitoring flags new findings against what you run.
Click through it at your own pace, or open it full screen.
Quick check
Does it need a privileged guest?
No. The advisory says an unprivileged guest can trigger it.
What is the quickest mitigation?
Use a userspace PV network backend or a dedicated network driver domain, per the advisory.
Sources
Last reviewed: 19 October 2026.
