XCP-ng 8.3 updates announcements and testing

dinhngtu

@XCP-ng-JustGreat Windows VMs will pass the Measured Boot check even after an edk2 update if BitLocker is set up to only use Secure Boot for integrity validation (see the "Configure TPM platform validation profile for native UEFI firmware configurations" policy, PCRs 7 and 11)

XCP-ng-JustGreat

@dinhngtu Thank you for bringing the TPM platform validation profile to my attention. I see that there is yet another nuance to the firmware boot process I didn't fully understand. I'm going to dig into those TPM group policies to see what that's all about. (Later on . . .) Found them, here:

vxgmichel

New `kernel` version in `xcp-ng-testing` for the next XCP-ng 8.3 LTS security update

We're adding a new kernel version to the security update we're planning for tomorrow.

What changed

kernel:
- Security fixes in the Xen netback and blkback drivers, XSA-526, XSA-527 and XSA-528.
- Synchronization with XenServer release 4.19.19-8.0.49. In this release, the XCP-ng patches for CVE-2026-98432 (possible race condition occurring during concurrent processing of re-transmitted TCP connection requests) have been removed as they are now part of the XenServer release. Also included are patches for CVE-2026-31431, a vulnerability in the Linux kernel's cryptographic interface known as "Copy Fail" that could allow unprivileged accounts to gain root privileges. As a mitigation, the authencesn module was disabled in the previous XCP-ng kernel release. It is now re-enabled. Finally, it includes patches for CVE-2021-47103, a use-after-free vulnerability in the TCP IP protocol.
- Fixes for the following CVEs are also included:
  - CVE-2026-31659
  - CVE-2026-31678
  - CVE-2026-43502
  - CVE-2026-52912
  - CVE-2026-52923
  - CVE-2026-52924
  - CVE-2026-68376
  - CVE-2026-74480
  - CVE-2026-74957
  - CVE-2026-80714
  - CVE-2026-52929
  - CVE-2026-63834
  - CVE-2026-43042
  - CVE-2026-72255

Versions

kernel: 4.19.19-8.0.46.14.xcpng8.3 -> 4.19.19-8.0.49.3.xcpng8.3

Test on XCP-ng 8.3

yum clean metadata --enablerepo=xcp-ng-testing,xcp-ng-candidates
yum update --enablerepo=xcp-ng-testing,xcp-ng-candidates
reboot

The usual update rules apply: pool coordinator first, etc.

What to test

As usual, normal use and anything else you want to test.

Test window before official release of the updates

1 day

We would like to thank users who shared feedback since our last call for testing:
@acebmxer, @Andrew, @XCP-ng-JustGreat

acebmxer

@vxgmichel

installed no issues to report. Cold booted windows 11 vm and linux vm. Backup job ran also with no issues.

Running transaction
  Updating   : kernel-4.19.19-8.0.49.3.xcpng8.3.x86_64                                                                  1/2 
  Cleanup    : kernel-4.19.19-8.0.46.14.xcpng8.3.x86_64                                                                 2/2 
  Verifying  : kernel-4.19.19-8.0.49.3.xcpng8.3.x86_64                                                                  1/2 
  Verifying  : kernel-4.19.19-8.0.46.14.xcpng8.3.x86_64                                                                 2/2

Andrew

@vxgmichel Update installed and running. Rolling pool reboot failed waiting to evacuate an empty host, I can't blame the update.

JeffBerntsen

@vxgmichel Installed to my test systems and all seems to be working well so far.

XCP-ng-JustGreat

@vxgmichel The new dom0 kernel version installed fine on my lab pool and everything appears to be running well.

hoh

@vxgmichel Installed on 10 lab hosts (mostly older hardware - Dell, HP, Fujitsu), no issues.

stormi

@Andrew said:

@vxgmichel Update installed and running. Rolling pool reboot failed waiting to evacuate an empty host, I can't blame the update.

Interesting. Worth a report to XO team?

flakpyro

Installed on my test hosts, no issues.