July 2026 Updates #1 for XCP-ng 8.3 LTS

Update Jul 28, 2026

New security and maintenance updates are available for XCP-ng 8.3 LTS.

📔

To update, follow this guide. You can also join the discussion on our community forum.
Host reboots are necessary after this update.

📋Summary

This release batch contains a security update for Xen. This update also brings a fix for a XAPI regression causing VBD leaks. Other minor changes were needed to build an updated XCP-ng 8.3 LTS installer (ISO).

🔒Security Updates

Xen

Multiple Xen Security Advisories have been published since the last update. Several of them affect XCP-ng to varying degrees, and the rest are included for transparency but are assessed as not impacting our products. See the references below each section for full details.

The following vulnerabilities are fixed by this update:

XSA-497 - buffer overruns in libfsimage iso9660 handling: Multiple vulnerabilities in the libfsimage iso9660 driver could allow a privilege escalation from a guest using pygrub. XCP-ng always runs pygrub in de-privileged mode, therefore the possible escalation was already limited.
XSA-500 - grant-table type confusion in grant-copy: Possible privilege escalation from guest to host privileges due to a type confusion in grant-copy operations. This can also lead to a DoS of the entire host.
XSA-501 - grant-table version change racing with other operations: Possible privilege escalation, DoS or information leak caused by a race during grant table v1/v2 switching. Only guests with multiple vCPUs can leverage this.
XSA-503 - out-of-bounds read in vRTC emulation: This could allow a malicious HVM guest to perform an out-of-bound read, allowing it to read Xen data due to a missing lock on the CMOS memory index cache. Data belonging to other guests is not at risk.
XSA-504 - Viridian STIMER division by zero: A host DoS could be triggered by an HVM guest with Viridian STIMERs enabled due to an unchecked divisor in the periodic Viridian STIMER handler.
XSA-505 - evtchn race between FIFO expand and reset: A malicious PV guest can cause a host DoS by crashing Xen due to a race between EVTCHNOP_expand_array and EVTCHNOP_reset. Memory corruption or privilege escalation cannot be ruled out.
XSA-507 - PoD does not try to reclaim special pages: A DoS, privilege escalation or data leak could be triggered by a guest started with Populate-on-Demand enabled by corrupting Xen's memory management when attempting to reclaim non-RAM pages. Only affects HVM and PVH guests started in PoD mode.

References:

Three of them are deemed to have a low impact or not exploitable in the supported use cases of XCP-ng:

XSA-499 - sysctl and platform-op locks open to abuse: Potential DoS due to the ability of a less privileged entity to stall more privileged ones due to an unfair lock acquisition on sysctl and platform operations. In XCP-ng, no unprivileged entity can directly leverage this vulnerability.
XSA-502 - vNUMA domain cleanup may race other operations: A potential DoS or information leak could be caused by the fact that vNUMA configuration data can still be accessed during domain destruction. XCP-ng does not use stub domains, which is required to trigger this vulnerability.
XSA-506 - incorrect buffer checks for DM_OP hypercalls: Xen hypervisor stack data could be leaked due to a missing buffer validation in DM_OP handling. As with XSA-502, this relies on stub domains, which XCP-ng does not use.

References:

Not impacting XCP-ng 8.3 LTS:

XSA-495 - x86 shadow paging is deprecated: Shadow paging is being deprecated due to complexity and security risks. XCP-ng disabled shadow paging in 8.3, so this does not apply.
XSA-496 - vIRQ event channel binding may break Xenstore: A defect in the VIRQ_DOM_EXC binding could tear down domain state and cause a DoS. This only affects Xen 4.21 and later whereas XCP-ng 8.3 uses Xen 4.17.
XSA-508 - pygrub is only supported in de-privileged mode: A guest using pygrub can escalate privileges to those of dom0 due to issues in the libfsimage FS driver. XCP-ng already runs pygrub in de-privileged mode.

References: VSA-2026-024 (XSA-495, XSA-496, XSA-508)

🪲 Improvements and bugfixes

Xapi

XAPI is XCP-ng's control plane, it is updated to 26.1.11-1.3 and includes the following fix:

Fix non-snapshotted VBDs staying attached after VM.revert

A regression was introduced to the VM.revert operation in xapi-26.1.4-3.3, which left VBDs attached to the VM when they are not present in the reverted-to snapshot (instead of destroying such VBDs, as done before).

As explained in XCP-ng documentation, systems affected by orphaned VBDs can be identified by running xapi_leaked_vbds.py script then the administrator can manually remove them accordingly.