August 2026 Updates #1 for XCP-ng 8.3 LTS

New maintenance updates are available for XCP-ng 8.3 LTS.

Summary

This is one of these batches of updates we group together to limit the number of maintenance operations on XCP-ng hosts. They are ready to be applied to your pools.

Let me introduce the changes to you. But first, a word about the update process.

Update precautions: follow the documented process

If your update habits, based on the fact that it "usually works", are to first update all hosts then reboot them one by one, you'll have a bad surprise, because in this case VMs will refuse to migrate, due to a temporary inconsistency between software expectations and local state.

This is expected behaviour, and is why the documented process (implemented in Xen Orchestra as the Rolling Pool Update feature) is to update hosts one by one, starting with the pool master. Disable, evacuate, update, reboot, next host. This guarantees that software and local state always agree. Also note that if LINSTOR storage is involved, any manual update process involves additional steps.

Reading this too late? Fortunately, restarting the toolstack on every host (xe-toolstack-restart) should be enough to allow you to continue, here.

Storage

In addition to bug fixes, this update introduces live leaf coalesce, faster SR scan on file-based SRs, and faster operations on Linstor SRs.

Live leaf coalesce for QCOW2

Coalescing is the operation of merging a virtual disk with its parent disk, typically after a snapshot has been deleted. This consolidates the snapshot's data back into the parent disk.

This release introduces a major change in how coalescing is managed. We can now coalesce disks without blocking access to the disk. Previously, since we couldn't safely coalesce a disk while it was in use, we worked around this by creating a temporary snapshot and coalescing that instead.

Live leaf coalesce prevents occasional failures caused by a large amount of writes to the disk during coalescing (with an error message mentioning a “bump in size”).

Not requiring a temporary snapshot also limits the amount of data reserved during coalescing on block-based SRs.

We plan to publish a technical blog post about this.

Better SR responsiveness thanks to faster SR scan

This update brings faster QCOW2 SR scans for all file-based SRs (EXT, XFS, NFS, etc.). On SRs with a very large number of VDIs, scans are now several times faster. For example, with 20,000 empty VDIs on an EXT SR backed by a basic NVMe disk, we went from 3 min 20 s down to 20 s. Since SR scanning is a very common operation, this greatly improves the responsiveness of operations on the SR.

Misc

Various fixes: tapdisk crashes, potential deadlock on VDI export, wrong VDI statistics computation, and more.

LINSTOR SR

• Performance improvements:
  • Faster VDI.deactivate operations (called during live migration and when shutting down a VM).
  • General improvement of underlying linstor commands.
• Bug fixes.

Control plane (XAPI)

XAPI is XCP-ng's control plane. It received various fixes as well as a several foundational improvements.

One of them is support for selecting the target image format (qcow2, vhd, raw) for live migration. Although not exposed yet in Xen Orchestra, it is available for the xe command line, as the image-format:<VDI-UUID>=<image format> parameter for the xe vdi-pool- migrate and xe vm-migrate commands. Make sure the destination SR supports the chosen image format.

Virtualization & System

Default dom0 console resolution changes

In EFI BIOS mode, Xen would always choose the maximum screen resolution, leading in some cases to out-of-range display errors or a resolution so high that text was difficult to read. The fix now makes display management more consistent with what is done in BIOS mode. If, as a result, the new screen resolution is lower than you would prefer, you can change it by following the instructions in XCP-ng's official documentation.

Guest Secure Boot: updated Revocation List

We updated the Revocation List (dbx) to version 1.6.5, maintained by Microsoft. See the Guest UEFI Secure Boot guide for more information on the role certificate databases play in Secure Boot and how they are managed in XCP-ng and in each virtual machine.

Other virtualization or system improvements and bugfixes

• The XCP-ng logo is now displayed when a UEFI virtual machine starts.

• ca-certificates: Refresh root certificates to connect to third parties depending on Certificate Authorities.
• krb5: The Kerberos 5 library has been updated to improve GSSAPI compatibility and prepare upcoming packages upgrade. It also a necessary update to satisfy the requirements for system transitions from XenServer 8.4 to XCP-ng 8.3.
• A few other packages were rebuilt or updated to facilitate future maintenance.
• Fix CVE-2026-45840 and CVE-2026-53227, related to openvswitch. Denial-of-Service via kernel panic, triggerable only from an already-compromised local process in dom0. Fixed as defence-in-depth.
• Fixed CVE-2026-64600, also known as RefluXFS. There's no XFS filesystem on XCP-ng by default, but users can create XFS local storage repositories. Given how an XFS SR is used in the context of XCP-ng, we consider the LPE risk to be low, but we fixed it anyway as a defence-in-depth measure.
• On some systems, PCIe expansion cards connected to a hotplug-capable PCI bus might not be seen at boot time. This release fixes this issue.

Networking

OpenSSH

A previous update had removed the automated loading of user configuration put in /etc/ssh/sshd_config.d/. This is now restored.

The update also fixes several minor vulnerabilities:

• CVE-2025-32728: A logic error was fixed regarding cases where x11_forwarding is disabled.
• CVE-2025-61984: Checks for forbidden characters have been tightened.
• CVE-2025-61985: A specific character has been disallowed in URL-encoded strings.
• CVE-2026-35385: The behavior when using scp with -O (without -p) has been corrected to prevent privilege escalation.
• CVE-2026-35388: The behavior regarding "ask/autoask" or ssh -O proxy ... has been corrected.

Libreswan

Libreswan is an optional package used by the SDN controller. It's a dependency of openswitch-ipsec.

We addressed DoS vulnerabilities (CVE-2026-12413, CVE-2026-50721, CVE-2026-50722) in encrypted Global Private Networks. Exposure appears minimal for XCP-ng environments, as Open vSwitch handles the underlying Libreswan orchestration directly.

Drivers and firmware

• amd-microcode: Update to the 2026-05-19 drop as redistributed by XenServer. Updated CPUs:
  • BRH-C1 00b00f21: 2025-10-17, rev 0b002161 -> 2025-10-17, rev 0b002162
  • BRHD-B0 00b10f10: 2025-10-17, rev 0b101058 -> 2025-10-17, rev 0b101059
• New alternate driver package qlogic-fastlinq-alt_8_42: this is an older version of the driver for older hardware for which the drivers we provide by default are "too recent." Notice how the version number is part of the package name itself, separated by underscores. This is a different package from the other alternate driver package named qlogic-fastlinq-alt. Install it only when needed.

User Interface

xsconsole

xsconsole is a console tool which allows to perform management tasks on XCP-ng.

It now allows to perform an emergency network reset without requiring to rename the management interface.

It will now also try to re-connect to XAPI when losing the connection, rather than letting users think that XAPI is down.

XO Lite 0.24.0

Xen Orchestra Lite was updated to version 0.24.0.

See you in the next update announcement!