CVE-2025-58149 is a vulnerability in libxl's PCI device passthrough detach logic that fails to remove access permissions to 64-bit memory Base Address Registers (BARs) after device detachment. This flaw allows a domain to retain access to memory regions of a device no longer assigned to it. For paravirtualized (PV) domains, the domain itself can map the leaked memory via page tables. For hardware virtual machine (HVM) domains, exploitation requires a compromised device model or stubdomain to map the leaked memory. The vulnerability has a high severity with a CVSS score of 7.5.