October 2026 Security Updates #2 for XCP-ng 8.3 LTS

New security updates are available for XCP-ng 8.3 LTS.

📋Summary

Security vulnerabilities have been detected and fixed in the xen hypervisor and tapdisk. Three other reported vulnerabilities are assessed as not impacting XCP-ng 8.3 LTS.

This update also includes a xen version bump to synchronize with upstream, replacing our own backport of security fixes with the upstream ones.

We recommend updating as soon as your schedule permits.

🔒Security Updates

Xen

XSA-515: Ineffectual Zenbleed workaround: A rework of the Zenbleed (XSA-433) fix introduced an inverted condition, so the mitigation is no longer applied when needed, which can allow an attacker to read data from different contexts running on the same core.

• References: VSA-2026-045, CVE-2026-79608, XSA-515

XSA-517: grant-table double version change race: Switching the grant table between v2 and v1 twice in a row can allow an unprivileged multi-vCPU guest using the grant table v2 interface to elevate its privileges to those of the host. Information leaks and Denial of Service are possible as well.

• References: VSA-2026-046, CVE-2026-79610, XSA-517

XSA-518: VMX VMentry failure with branch tracing: On Intel (and VIA/Zhaoxin) systems, a special combination of branch tracing and debug states still triggers a VMEntry failure that the fix for XSA-308 did not cover. HVM/PVH guest userspace code can use this to crash the guest, resulting in a guest-level Denial of Service.

• References: VSA-2026-047, CVE-2026-79611, XSA-518

XSA-520: gnttab cache-flush page reference leak: The cache-flush error path fails to drop a page reference when the page is owned by a special system domain. The most likely outcome is a Denial of Service of the privileged dom0, and therefore of the entire host and its VMs.

• References: VSA-2026-048, CVE-2026-102700, XSA-520

Tapdisk

XSA-521: Out-of-bounds access in tapdisk: tapdisk missed a boundary check on the multi-page ring size requested by the frontend and assumed it did not exceed 8 pages. A buggy or malicious guest can cause a stack overflow, potentially leading to code execution within the tapdisk process running as root in dom0 granting the attacker administrator privileges on the control domain.

• References: VSA-2026-049, CVE-2026-102701, XSA-521

Not Fixed in this release

These vulnerabilities do not impact XCP-ng 8.3. Where it makes sense, the fixes might be integrated in a later update to keep synchronized with upstream and ease maintenance.

Xen

XSA-514: Guests can crash xenstored during Live Update: During a live update of xenstore, a watch state record is written with two bytes missing, which can crash or corrupt xenstored and block further domain administration. Only Xen 4.22 is vulnerable, while XCP-ng 8.3 LTS ships Xen 4.17 and is therefore not impacted.

• References: CVE-2026-79607, XSA-514

XSA-516: XPTI may break on huge-memory systems: On x86 systems with more than 5 TiB of RAM the Meltdown mitigation (XPTI) does not cover all of a 64-bit PV guest's memory, which can allow privilege escalation, information disclosure, or a host-wide Denial of Service. XCP-ng 8.3 LTS does not officially support PV and is not impacted.

• References: CVE-2026-79609, XSA-516

XSA-519: Multiple issues with GNTTABOP_cache_flush: Two issues were reported in the grant-table cache-flush path: an underflow that can make the hypervisor walk most of the address space (crash / host Denial of Service), and a missing restriction that can corrupt memory granted by another domain. Only Arm systems are affected; XCP-ng 8.3 LTS is x86-only and is not impacted.

• References: CVE-2026-102699, CVE-2026-102702, XSA-519

Tapdisk bugfix

Although this is a security update, we included a bugfix in tapdisk that was ready:

• Fix a potential crash on close if a coalesce was in progress. This should not happen in the real world and was only found during some extensive testing done by our storage team.