The Linux kernel's xen-netback component did not properly validate the lower bound of the 'multi-queue-num-queues' parameter from a Xen guest. While it checked that the requested number of queues did not exceed the maximum, it failed to reject zero as an invalid value. This allowed a guest to request zero queues, causing the backend to allocate zero-sized memory and trigger WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this leads to a guest-to-host denial of service. The fix involves adding a zero check to reject zero-queue configurations, aligning with the Xen network interface specification and similar validation in xen-blkback.

A malicious or buggy Xen guest can cause a denial of service on the host by triggering a kernel warning that leads to a panic if the host is configured with panic_on_warn=1. This does not affect confidentiality or integrity but impacts availability of the host system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, hosts should consider disabling panic_on_warn or applying any available kernel updates that address this issue. Monitoring for updates from the Linux kernel maintainers or Xen project is recommended.