The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
4.5.1-0ubuntu14.5.1-0ubuntu24.6.0-1ubuntu14.6.0-1ubuntu24.6.0-1ubuntu44.6.0-1ubuntu4.14.6.0-1ubuntu4.24.6.0-1ubuntu4.34.6.5-0ubuntu14.6.5-0ubuntu1.1+2 more4.9.0-0ubuntu34.9.0-0ubuntu44.9.2-0ubuntu14.11.3+24-g14b62ab3e5-1ubuntu14.11.3+24-g14b62ab3e5-1ubuntu24.11.3+24-g14b62ab3e5-1ubuntu2.24.11.3+24-g14b62ab3e5-1ubuntu2.34.9.2-0ubuntu24.9.2-0ubuntu64.9.2-0ubuntu7Exploitability
AV:NAC:LPR:NUI:NScope
S:UImpact
C:LI:LA:LCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L