November 2026 Security Updates #2 for XCP-ng 8.3 LTS
New updates are available for XCP-ng 8.3 LTS.
Host reboots are necessary after this update.
XCP-ng's updates are cumulative, so applying updates now will also apply any previous updates that weren't applied to your hosts. Update advisories: https://xcp-ng.org/blog/tag/update/.
Summary
As announced in our previous update post published yesterday (please read too it if you missed it), this update fixes a critical vulnerability in the Linux kernel of the control domain (Dom0). It can be triggered remotely, without authentication, by anyone able to send network traffic to the host, and could lead to a compromise of the host.
We advise updating as soon as possible. If you can't reboot your hosts right away, don't apply the update yet, and apply the iptables-based mitigation described below instead. It takes effect immediately, without a reboot, and protects your hosts until they run the fixed kernel, so you may plan the reboot for your next maintenance window.
Some details below. The comprehensive version is the Vates Security Advisory (VSA) itself.
Security updates
Linux kernel: use-after-free in IPv4 TCP connection handling
A flaw in the way the Linux kernel handles incoming IPv4 TCP connections lets an attacker make the kernel use memory that was already freed, by sending TCP packets that carry IP options. This can lead to code execution with kernel privileges in Dom0, the control domain. Dom0 controls the whole host, so its compromise means a compromise of the host and of all its VMs.
Anyone who can send TCP traffic to the host can attempt this, for example from its management network, including VMs connected to that network.
A public exploit exists. It relies on MPTCP, which the XCP-ng 8.3 kernel doesn't have, so this exploit doesn't work against XCP-ng. The underlying bug is present nonetheless, and other ways to exploit it can't be ruled out.
References: VSA-2026-056, CVE-2026-98432
