Posts

• RE: XCP-ng 8.3 updates announcements and testing

  New kernel version in xcp-ng-testing for the next XCP-ng 8.3 LTS security update

  We're adding a new kernel version to the security update we're planning for tomorrow.

  What changed

  • kernel:
    • Security fixes in the Xen netback and blkback drivers, XSA-526, XSA-527 and XSA-528.
    • Synchronization with XenServer release 4.19.19-8.0.49. In this release, the XCP-ng patches for CVE-2026-98432 (possible race condition occurring during concurrent processing of re-transmitted TCP connection requests) have been removed as they are now part of the XenServer release. Also included are patches for CVE-2026-31431, a vulnerability in the Linux kernel's cryptographic interface known as "Copy Fail" that could allow unprivileged accounts to gain root privileges. As a mitigation, the authencesn module was disabled in the previous XCP-ng kernel release. It is now re-enabled. Finally, it includes patches for CVE-2021-47103, a use-after-free vulnerability in the TCP IP protocol.
    • Fixes for the following CVEs are also included:
      • CVE-2026-31659
      • CVE-2026-31678
      • CVE-2026-43502
      • CVE-2026-52912
      • CVE-2026-52923
      • CVE-2026-52924
      • CVE-2026-68376
      • CVE-2026-74480
      • CVE-2026-74957
      • CVE-2026-80714
      • CVE-2026-52929
      • CVE-2026-63834
      • CVE-2026-43042
      • CVE-2026-72255

  Versions

  • kernel: 4.19.19-8.0.46.14.xcpng8.3 -> 4.19.19-8.0.49.3.xcpng8.3

  Test on XCP-ng 8.3

  yum clean metadata --enablerepo=xcp-ng-testing,xcp-ng-candidates
  yum update --enablerepo=xcp-ng-testing,xcp-ng-candidates
  reboot
  

  The usual update rules apply: pool coordinator first, etc.

  What to test

  As usual, normal use and anything else you want to test.

  Test window before official release of the updates

  1 day

  We would like to thank users who shared feedback since our last call for testing:
  @acebmxer, @Andrew, @XCP-ng-JustGreat

  posted in News

  V

  vxgmichel
  
• RE: XCP-ng 8.3 updates announcements and testing

  New maintenance update candidates for XCP-ng 8.3 LTS

  This update is focused on security fixes.

  What changed

  • edk2:
    Sync with XenServer edk2-20220801-1.7.13. The update fixes vulnerabilities allowing an unauthenticated attacker on the local network to compromise a VM during PXE boot, or enable a guest VM administrator to bypass Secure Boot. See below the list of the corresponding CVEs:

    • CVE-2026-97631
    • CVE-2024-38796
    • CVE-2024-38797
    • CVE-2019-14560
    • CVE-2022-36763
    • CVE-2022-36764
    • CVE-2026-45447
    • CVE-2026-111497

  Versions

  • edk2: 20220801-1.7.11.2.xcpng8.3 -> 20220801-1.7.13.1.xcpng8.3

  Test on XCP-ng 8.3

  yum clean metadata --enablerepo=xcp-ng-testing,xcp-ng-candidates
  yum update --enablerepo=xcp-ng-testing,xcp-ng-candidates
  reboot # not mandatory but recommended for testing
  

  The usual update rules apply: pool coordinator first, etc.

  What to test

  As usual, normal use and anything else you want to test.

  Additionally, a cold boot (shutdown and start) of the UEFI VMs would also help testing the edk2 fix.

  Test window before official release of the updates

  About 4 days

  We would like to thank users who shared feedback since our last call for testing: @acebmxer, @jr-m4, @bufanda, @flakpyro, @Andrew, @MajorP93, @JeffBerntsen, @manilx, @XCP-ng-JustGreat, @john205, @Greg_E.

  We are aware of the frequency of these updates and strive to batch packages as much as possible. However, recent unplanned security updates require immediate attention. While drafting this message, we received another security update that we will release shortly.

  posted in News

  L

  lmolina
  
• RE: XCP-ng 8.3 updates announcements and testing

  @MajorP93 said:

  Aaaaand it happened for the next VM.
  Apart from updating XO I did not change anything...
  It looks like RPU is failing on every single VM that has DMC enabled...
  To me it looks like a regression

  Hi, did you manage to sort it out ? if not your logs will help us to troubleshoot see related documentation as shared earlier:
  https://docs.xcp-ng.org/troubleshooting/log-files/#produce-a-status-report

  posted in News

  R

  rzr
  
• RE: XCP-ng 8.3 updates announcements and testing

  @acebmxer said:

  applying the updates on hosts at work. So far 2 out of 3 pools updated succesfully. however when i go to attempt to apply updates on the last pool i see this...

  @acebmxer, thanks for the feedback. We have no explanation at the moment. So far, all our tests have been successful. We may be missing a specific scenario that triggers this error.

  Do you have any additional information in the host logs?

  If not, could you export and send us a status report using xen-bugtool? One of our developers may be able to spot something that helps explain the issue.

  posted in News

  L

  lmolina
  
• RE: XCP-ng 8.3 updates announcements and testing

  @john205 said:

  "apply the iptables-based mitigation described below"

  Thanks for reporting the mistake. The mitigation is described in the VSA.

  The blog is now fixed!

  posted in News

  L

  lmolina
  
• RE: XCP-ng 8.3 updates announcements and testing

  @manilx

  If we could have waited, we would have. However, the xen security update released yesterday, given its critical nature, did not allow for that.

  Please rest assured that we are aware of this issue and are doing our utmost to keep the number of releases to a minimum. We are also discussing how to communicate regarding the most critical updates and how to limit the need for reboots.

  posted in News

  G

  gduperrey
  
• RE: XCP-ng 8.3 updates announcements and testing

  We have just released a security update for a critical Linux kernel vulnerability CVE-2026-98432 / VSA-2026-056.

  Full details are available on the blog: https://xcp-ng.org/blog/2026/11/04/november-2026-security-updates-2-for-xcp-ng-8-3-lts/

  posted in News

  L

  lmolina
  
• RE: XCP-ng 8.3 updates announcements and testing

  @MajorP93

  We discussed your feedback yesterday, but we don't have an explanation at the moment. Our Windows expert tried to reproduce the behavior but was unable to trigger this error.

  Furthermore, we haven't encountered any issues on our end with the RPU (Rolling Pool Update) operations performed during our tests, whether done manually or via XO. It is possible, however, that we are missing the specific scenario (VMs or configuration) required to trigger this one.

  Have you been able to find any further information in the host logs?

  If not, could you export and send us a status report using xen-bugtool? Perhaps one of our developers will be able to spot something in it that helps explain the issue.

  posted in News

  G

  gduperrey
  
• RE: XCP-ng 8.3 updates announcements and testing

  Thank you everyone for your tests and your feedback!

  The updates are live now.

  Note that the update includes an additional kernel security update. Another vulnerability was disclosed recently, we will provide provide the update soon. Checkout the blog post for detailed information: https://xcp-ng.org/blog/2026/11/03/november-2026-security-and-maintenance-updates-1-for-xcp-ng-8-3-lts/

  posted in News

  L

  lmolina
  
• RE: XCP-ng 8.3 updates announcements and testing

  New xapi update in xcp-ng-testing for the next XCP-ng 8.3 LTS maintenance update

  We've just published a new xapi package in the xcp-ng-testing repository:

  xapi: 26.1.21-1.2.xcpng8.3 -> 26.1.21-1.3.xcpng8.3
  

  It reverts an upstream commit (released to XCP-ng's testing as 26.1.21-1) that introduced a regression, which was found by Veeam. This package will be part of the official maintenance update that will be published as expected tomorrow.

  Thanks again to all the testers who helped with this milestone.

  posted in News

  L

  lmolina