CVE-2014-9030: Debian Linux

High severity, CVSS 7.1. EPSS: 2.2% chance of exploitation in the next 30 days.

The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.

Affected products

• Debian Debian Linux: version 7.0 only
• Opensuse Opensuse: version 13.1 only; version 13.2 only
• Xen Xen: version 3.2.0 only; version 3.2.1 only; version 3.2.2 only; version 3.2.3 only; version 3.3.0 only; version 3.3.1 only; …

Published 2014-11-24. Last modified 2026-06-17.