XSAs released on 2026-11-10
Key points
The Xen Project published a new batch of Xen security advisories (XSAs) on 2026-11-10, and Qubes OS has stated that its security is affected. Two of the advisories affect Qubes OS, three do not, and one is still being assessed.
Affects Qubes OS
- XSA-524 and XSA-525 both affect the security of Qubes OS.
- Both are covered by Qubes security bulletin QSB-123, which the announcement points to for details.
Does not affect Qubes OS
- XSA-529 and XSA-530 are not relevant because Qubes OS does not use XAPI.
- XSA-531 is classed as denial of service only.
- No user action is needed for these three.
Still under investigation
- The Qubes security team has not yet determined whether XSA-532 has security implications for Qubes OS.
- The announcement and the XSA tracker will be updated once its status is known.
Background
- Qubes OS is built on the Xen hypervisor, so each publicly disclosed Xen vulnerability is checked for its impact on Qubes.
- A Qubes security bulletin (QSB) is issued only when an XSA does affect Qubes OS; QSBs are also issued for vulnerabilities unrelated to Xen.
- Because QSBs cannot confirm that an XSA is harmless, the project also keeps an XSA tracker listing every publicly disclosed XSA and whether it affects Qubes OS.
Summary by DistroNews, based on the original post.
The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: XSA-524: See QSB-123. XSA-525: See QSB-123. XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-529: Qubes OS does not use XAPI. XSA-530: Qubes OS does not use XAPI. XSA-531: Denial of service only. XSAs that are still under investigation The Qubes security team is still analyzing the security implications of the following XSA: XSA-532 Once the status of this XSA has been determined, we will update this announcement and the XSA tracker. About this announcement Qubes OS uses the Xen hypervisor as part of its architecture. When the Xen Project publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a Xen security advisory (XSA). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a Qubes security bulletin (QSB). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only positive confirmation that certain XSAs do affect the security of Qubes OS. QSBs cannot provide negative confirmation that other XSAs do not affect the security of Qubes OS. Therefore, we also maintain an XSA tracker, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.
This is the summary Qubes OS News published with the story. The full text is on the original page.
Read the original at qubes-os.org