[TheDong]

Xen has a very responsible track record; they communicate clearly the scope and detail of vulnerabilities.

This skews the CVE stats significantly since the kernel developers (aka kvm) rarely actually request CVE ids.

[bonzini]

Ehm, I always request CVE ids. KVM has had no serious VM escape in quite some time.