CVE-2015-5166: Fedoraproject Fedora

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain privileges by unplugging a block device twice.

Affected products

• Fedoraproject Fedora: version 21 only; version 22 only
• Xen Xen: up to and including 4.5.0; version 4.5.1 only

Published 2015-08-12. Last modified 2026-06-17.