@LucienLassalle said:
@Rod-G Hello,
We are indeed aware of this vulnerability on the Kernel. But I still thank you for this message, it shows that the community is attentive to the subject of safety on our products.
I also fixed the PoC, and I managed to reproduce the flaw. I also took the opportunity to start making a fix.
You highlighted it, but this security flaw is mitigated by respecting our best practices as well as the fact that we are a hypervisor which must keep restricted access.
For vulnerabilities like CopyFail, DirtyFrag, Fragnesia, we have just released the fix. The blog post is here: https://xcp-ng.org/blog/shell shockers/2026/06/02/june-2026-updates-1-for-xcp-ng-8-3-lts/
This being similar, there is a good chance that we will fix it and give the same severity.
I would also like to anticipate the question of why a fix has not already been included in the security update released today. Our procedure aims for security but also stability, we pass a CI to avoid regressions, as well as a user testing period. With a deadline of less than a day, this would not have been possible.
Just a quick general reminder, but if you find a security flaw and want to report it to us, the best thing to do is to contact our email: security [at] this domain name.
I hope I was able to give you the most complete answer, don't hesitate if anything is missing.
Respectfully,
Thanks to you and the security team for working on this fix. Has the patched XCP-ng 8.3 kernel been tested with SMB-based storage repositories to confirm there are no regressions in storage connectivity or pool operations? It would be helpful to hear about any compatibility results before deploying the fix across multiple hosts.
