a) only 10% of the fleet are running a version of the hypervisor that is affected by the bug
b) based on the turnover rate, they expect 10% to need rebooting under the customers by the date the bugs are being released.
c) 10% are running a combination of the affected hypervisor and vm's that are reasonably at risk of exploitation, other's may have the faulty hypervisor but either are being used as single tenant (there is no risk of someone breaking out and affecting someone else) or are running vm's that may not be able to break out depending on the nature of bugs.
Just speculating, any ideas?