XCP-ng 8.3 updates announcements and testing

XCP-ng-JustGreat

@dinhngtu Thank you for bringing the TPM platform validation profile to my attention. I see that there is yet another nuance to the firmware boot process I didn't fully understand. I'm going to dig into those TPM group policies to see what that's all about. (Later on . . .) Found them, here:

vxgmichel

New `kernel` version in `xcp-ng-testing` for the next XCP-ng 8.3 LTS security update

We're adding a new kernel version to the security update we're planning for tomorrow.

What changed

kernel:
- Security fixes in the Xen netback and blkback drivers, XSA-526, XSA-527 and XSA-528.
- Synchronization with XenServer release 4.19.19-8.0.49. In this release, the XCP-ng patches for CVE-2026-98432 (possible race condition occurring during concurrent processing of re-transmitted TCP connection requests) have been removed as they are now part of the XenServer release. Also included are patches for CVE-2026-31431, a vulnerability in the Linux kernel's cryptographic interface known as "Copy Fail" that could allow unprivileged accounts to gain root privileges. As a mitigation, the authencesn module was disabled in the previous XCP-ng kernel release. It is now re-enabled. Finally, it includes patches for CVE-2021-47103, a use-after-free vulnerability in the TCP IP protocol.
- Fixes for the following CVEs are also included:
  - CVE-2026-31659
  - CVE-2026-31678
  - CVE-2026-43502
  - CVE-2026-52912
  - CVE-2026-52923
  - CVE-2026-52924
  - CVE-2026-68376
  - CVE-2026-74480
  - CVE-2026-74957
  - CVE-2026-80714
  - CVE-2026-52929
  - CVE-2026-63834
  - CVE-2026-43042
  - CVE-2026-72255

Versions

kernel: 4.19.19-8.0.46.14.xcpng8.3 -> 4.19.19-8.0.49.3.xcpng8.3

Test on XCP-ng 8.3

yum clean metadata --enablerepo=xcp-ng-testing,xcp-ng-candidates
yum update --enablerepo=xcp-ng-testing,xcp-ng-candidates
reboot

The usual update rules apply: pool coordinator first, etc.

What to test

As usual, normal use and anything else you want to test.

Test window before official release of the updates

1 day

We would like to thank users who shared feedback since our last call for testing:
@acebmxer, @Andrew, @XCP-ng-JustGreat

acebmxer

@vxgmichel

installed no issues to report. Cold booted windows 11 vm and linux vm. Backup job ran also with no issues.

Running transaction
  Updating   : kernel-4.19.19-8.0.49.3.xcpng8.3.x86_64                                                                  1/2 
  Cleanup    : kernel-4.19.19-8.0.46.14.xcpng8.3.x86_64                                                                 2/2 
  Verifying  : kernel-4.19.19-8.0.49.3.xcpng8.3.x86_64                                                                  1/2 
  Verifying  : kernel-4.19.19-8.0.46.14.xcpng8.3.x86_64                                                                 2/2

Andrew

@vxgmichel Update installed and running. Rolling pool reboot failed waiting to evacuate an empty host, I can't blame the update.

JeffBerntsen

@vxgmichel Installed to my test systems and all seems to be working well so far.

XCP-ng-JustGreat

@vxgmichel The new dom0 kernel version installed fine on my lab pool and everything appears to be running well.

hoh

@vxgmichel Installed on 10 lab hosts (mostly older hardware - Dell, HP, Fujitsu), no issues.

stormi

@Andrew said:

@vxgmichel Update installed and running. Rolling pool reboot failed waiting to evacuate an empty host, I can't blame the update.

Interesting. Worth a report to XO team?

flakpyro

Installed on my test hosts, no issues.

gduperrey

Updates are live now

Thank you everyone for your tests and your feedback!

This includes updates that you have tested, as well as security updates that were under embargo.

Check out the blog post for the full list of fixes and any post-update steps: https://xcp-ng.org/blog/2026/11/10/november-2026-security-updates-3-for-xcp-ng-8-3-lts/

If you installed the kernel from our last call for testing, please read on. You can check with rpm -q kernel.

The released kernel is not the 4.19.19-8.0.49.3 you tested, but 4.19.19-8.0.46.16. Its release number is lower, so a regular update will leave your hosts on 4.19.19-8.0.49.3. We identified some issues in 4.19.19-8.0.49.3.

To downgrade and install kernel-4.19.19-8.0.46.16, run the following commands:

yum clean metadata
yum downgrade --setopt=protected_packages= kernel-4.19.19-8.0.46.16.xcpng8.3
yum update
reboot