CVE-2018-19966: Debian Linux

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595.

Affected products

• Debian Debian Linux: version 9.0 only
• Xen Xen: from 4.11.0, up to and including 4.11.1

Published 2018-12-08. Last modified 2026-06-17.