Xen Fixes Critical XSA-523 Vulnerabilities Threatening Dom0 Memory
The XSA-523 security advisory addresses two flaws in Xen’s grant copy implementation. According to Xen Project, a malicious guest VM may read and write memory belonging to other domains, including Dom0.
The XSA-523 vulnerabilities in Xen’s grant copy implementation allow, according to Xen Project, a malicious guest to read and write arbitrary memory belonging to other domains, including the privileged Dom0 domain. The advisory concerns CVE-2026-102703 and CVE-2026-102704.
All Xen versions since 4.6 are vulnerable. Versions 4.5 and older are not vulnerable, according to Xen Project. The project states that no known mitigation exists; applying the provided patches addresses the issue.
XSA-523 vulnerabilities break VM isolation
According to Xen Project, a malicious guest may access memory that does not belong to it. This includes the memory of other guest VMs and Dom0, the hypervisor’s privileged control domain.
This represents a critical breach of virtualization isolation. An attacker controlling a guest VM may affect the memory of other VMs or the privileged Dom0, which could lead to host compromise.
- CVE-2026-102703 and CVE-2026-102704 are included in the XSA-523 advisory.
- Xen versions since 4.6 are vulnerable.
- Xen 4.5 and older versions are not vulnerable, according to Xen Project.
- Xen Project states that no known mitigation exists; applying patches is the solution.
Updates for XCP-ng and Qubes OS
XCP-ng released an update for version 8.3 LTS. Hosts must be rebooted after installation.
Qubes OS released fixed packages for Qubes 4.3. Dom0 must be rebooted after the update.
For other Xen downstream distributions and platforms, administrators should monitor their own security channels. The scope of impact depends on the Xen version in use and the availability of an update from the specific vendor.
What administrators should do
Administrators should verify the Xen version in use and deploy the fix provided by their platform vendor. Since Xen Project does not list a known mitigation, applying patches is the priority. For XCP-ng, hosts must then be rebooted; for Qubes OS, Dom0 must be rebooted.
The advisory does not report confirmed exploitation in the wild. Further developments will depend on fixes being released for other Xen platforms and any reports of real-world exploitation.
Sources
- Xen Project — XSA-523 – Primarily confirms the CVEs, technical cause, arbitrary reading and writing of memory belonging to other domains including Dom0, the affected version range, the absence of a known mitigation, and patch availability.
- XCP-ng — November 2026 Security and Maintenance Updates #1 – Confirms the release of a fix for XCP-ng 8.3 LTS, the need to reboot hosts, and the severity of possible guest-to-host escape.
- Qubes OS — QSB-121 – Confirms the impact on supported Qubes OS releases and configurations, the fixed Xen 4.19.6-3 package for Qubes 4.3, and the need to reboot Dom0.
Verified and updated: 11/04/2026 15:22
