A malicious qube can read or alter memory belonging to other qubes, including dom0, through two newly disclosed Xen vulnerabilities, the Qubes security team warns.
The team’s QSB-121 bulletin, published on 3 November, says every supported Qubes OS release and configuration is affected. For Qubes 4.3, it identifies Xen packages version 4.19.6-3 in dom0 as containing the fixes.
Two mistakes in grant-copy validation
The upstream Xen advisory, XSA-523, assigns CVE-2026-102703 and CVE-2026-102704. Both concern the handling of batched Grant Copy operations, where Xen retains previously validated information to improve performance.
For CVE-2026-102703, Xen could confuse frame numbers with grant references. CVE-2026-102704 involves a misplaced check: copying by frame number should be restricted to the calling guest’s own memory.
Xen says versions 4.6 onward are vulnerable; versions 4.5 and earlier are unaffected. It lists no known mitigation and supplies patches for supported branches. Neither advisory provides a CVSS score or reports exploitation in the wild. The disclosed consequence is nevertheless significant: an untrusted guest can access memory outside its own domain, including the privileged dom0 domain.
The Xen Project credits discovery to Anthropic using Claude, with validation by Stephan Lipp of Ada Logics. It also names the CodeAnt AI Security Research Team as an independent reporter.
Install the update, then restart dom0
Qubes says the patched packages will move from security-testing to the stable repository over the following two weeks, after community testing.
After installing the fixed Xen packages, dom0 must be restarted for the changes to take effect. Anti Evil Maid users also need to reseal their secret passphrase because the new Xen binaries change PCR18 and PCR19 values.
The official update instructions explain how to check manually through Qubes Tools, even before an update notification appears. They recommend the Qubes updater or its supported command-line equivalents rather than direct package-manager update commands, which bypass Qubes-specific update security measures. Save work before restarting components.
