Xen, when using x86 Intel processors and the VMX virtualization extension is enabled, does not properly handle cpuid instruction emulation…

published 2014-01-07 12 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1934

cvss: 4.6; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits: 0; none known

Xen, when using x86 Intel processors and the VMX virtualization extension is enabled, does not properly handle cpuid instruction emulation when exiting the VM, which allows local guest users to cause a denial of service (guest crash) via unspecified vectors.

Patch / fix

distros 1

kernel RHEL 5 2.6.18-238.19.1.el5
kernel-PAE RHEL 5 2.6.18-238.19.1.el5
kernel-xen RHEL 5 2.6.18-238.19.1.el5
kernel-kdump RHEL 5 2.6.18-238.19.1.el5
kernel-debuginfo-common RHEL 5 2.6.18-238.19.1.el5

red hat advisories RHSA-2011:0927

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-1936 updated 2025-11-21 cvss 4.9

kernel: xen: vmx: insecure cpuid vmexit

Red Hat Enterprise Linux (v. 5.6.z server) kernel 2.6.18-238.19.1.el5, kernel-PAE 2.6.18-238.19.1.el5, kernel-xen 2.6.18-238.19.1.el5, kernel-kdump 2.6.18-238.19.1.el5, kernel-debuginfo-common 2.6.18-238.19.1.el5
fixed: vendor fix RHSA-2011:0927

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.6	AV:A/AC:H/Au:N/C:N/I:N/A:C

References

rhn.redhat.com /errata/RHSA-2011-0927.html
vendor-advisory
openwall.com /lists/oss-security/2011/07/07/3
mailing-list

Sources

CVE List CVE-2011-1936
NVD CVE-2011-1936

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary