widely-deployed-product-advisorycloud-service-vulnerabilityembedded-device-vulnerability

Xen Patches Cross-Guest Data Leak on AMD Zen1 CPUs

Patch & Detection Intelligence · 2 sources · Updated 4mo ago · First seen Apr 17, 2026

Xen disclosed XSA-488, a transient execution vulnerability named Floating Point Divider State Sampling that affects x86 deployments running on vulnerable AMD Fam17h (Zen1) processors. The flaw was identified by researchers from the CISPA Helmholtz Center for Information Security, and Xen said an attacker may be able to infer data from other execution contexts, including other guest VMs, creating a cross-tenant confidentiality risk for virtualized environments.

According to the advisory, all Xen versions are affected when deployed on the impacted CPU family. Xen said no mitigations are currently available, but released fixes for xen-unstable and the supported 4.20/4.19, 4.18, and 4.17 branches, urging operators on affected hardware to apply the relevant patches to reduce exposure.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Apr 17, 2026

Apr 17, 20267mo ago
Xen discloses XSA-488 and releases patches
Xen published Security Advisory 488, stating that all Xen versions are affected on vulnerable CPUs and that attackers may be able to infer data from other contexts, including other guests. Xen also released patches for xen-unstable and the Xen 4.20/4.19, 4.18, and 4.17 branches, while noting that no mitigations were available.
Apr 17, 20267mo ago
CISPA researchers discover Xen FP Divider State Sampling issue
Researchers from the CISPA Helmholtz Center for Information Security identified a new transient execution vulnerability dubbed Floating Point Divider State Sampling affecting Xen on x86 systems running on AMD Fam17h CPUs based on the Zen1 microarchitecture.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Organizations

1 linked

Advanced Micro Devices

Observables

4 linked

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Xenbits XenNews · Apr 17, 2026

XSA-488 - Xen Security AdvisoriesOpen source ↗

Oss Security Mailing ListNews · Apr 17, 2026

oss-sec: Xen Security Advisory 488 v1 - x86: Floating Point Divider State SamplingOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

widely-deployed-product-advisorycloud-service-vulnerabilityembedded-device-vulnerability

Xen Patches Cross-Guest Data Leak on AMD Zen1 CPUs

Patch & Detection Intelligence · 2 sources · Updated 4mo ago · First seen Apr 17, 2026

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Apr 17, 2026

Apr 17, 20267mo ago
Xen discloses XSA-488 and releases patches
Xen published Security Advisory 488, stating that all Xen versions are affected on vulnerable CPUs and that attackers may be able to infer data from other contexts, including other guests. Xen also released patches for xen-unstable and the Xen 4.20/4.19, 4.18, and 4.17 branches, while noting that no mitigations were available.
Apr 17, 20267mo ago
CISPA researchers discover Xen FP Divider State Sampling issue
Researchers from the CISPA Helmholtz Center for Information Security identified a new transient execution vulnerability dubbed Floating Point Divider State Sampling affecting Xen on x86 systems running on AMD Fam17h CPUs based on the Zen1 microarchitecture.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Organizations

1 linked

Advanced Micro Devices

Observables

4 linked

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Xenbits XenNews · Apr 17, 2026

XSA-488 - Xen Security AdvisoriesOpen source ↗

Oss Security Mailing ListNews · Apr 17, 2026

oss-sec: Xen Security Advisory 488 v1 - x86: Floating Point Divider State SamplingOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Xen Patches Cross-Guest Data Leak on AMD Zen1 CPUs

How this story unfolded

Xen discloses XSA-488 and releases patches

CISPA researchers discover Xen FP Divider State Sampling issue

Related entities

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Xen warns AMD Zen 2 opcode cache flaw can enable guest-to-host escalation

Xen Advisories Disclose Linux Guest Kernel Flaws Enabling Privilege Escalation

StackWarp Side-Channel Weakness Undermines AMD SEV-SNP Confidential VMs

Xen Patches Cross-Guest Data Leak on AMD Zen1 CPUs

How this story unfolded

Xen discloses XSA-488 and releases patches

CISPA researchers discover Xen FP Divider State Sampling issue

Related entities

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Xen warns AMD Zen 2 opcode cache flaw can enable guest-to-host escalation

Xen Advisories Disclose Linux Guest Kernel Flaws Enabling Privilege Escalation

StackWarp Side-Channel Weakness Undermines AMD SEV-SNP Confidential VMs