Last updated: November 8, 2026
The whole promise of a hypervisor is isolation: whatever happens inside one VM stays there. XSA-523 breaks that promise on Xen. If you run XCP-ng in a homelab, use Qubes OS, or host other people’s VMs on Xen, this one matters. Proxmox, VirtualBox and VMware users are not affected.
What the Bug Does
Xen moves data between VMs with an operation called grant copy. To make batches of copies within the same memory page faster, Xen reuses permission checks it already did. In some cases it skipped a check it should have repeated. A guest that abuses this can read and write memory belonging to other guests and to dom0, the privileged VM that manages the host.
Reading another VM’s memory can leak passwords and keys. Writing to dom0’s memory is effectively full control of the host. The advisory does not report any attacks so far.
Who Is Affected
| Platform | Status |
|---|---|
| Xen 4.17 – 4.19, unstable | Patches available from the Xen project |
| Xen 4.6 – 4.16 | Affected, no patch (4.16 support ended in December 2024) |
| Xen 4.5 and older | Not affected |
| XCP-ng 8.3 | Fixed in xen-4.17.7-4.2.xcpng8.3 (Nov 3). Vates rates it Critical. Reboot required |
| Qubes OS 4.3 | Fixed in Xen 4.19.6-3 for dom0, in security-testing first. Restart required |
| Debian | Fixed in sid. Bookworm, trixie and forky were still vulnerable on Nov 4 |
| Proxmox, VirtualBox, VMware | Not affected (not Xen) |
What to Do
XCP-ng 8.3: update from Xen Orchestra or the host console, then reboot each host. With a pool, migrate VMs away, update, reboot, and repeat host by host.
yum update
rebootCheck the installed Xen package afterwards with rpm -q xen-hypervisor. It should be 4.17.7-4.2.xcpng8.3 or newer.
Qubes OS 4.3: the fixed packages were published to the security-testing repository first, with the stable release expected within about two weeks. Update dom0 and restart it:
sudo qubes-dom0-update --enablerepo=qubes-dom0-security-testing
# then restart the computerIf you use Anti Evil Maid, you will need to reseal your secret after the update, because the measured values change.
Debian with Xen: watch the Debian security tracker for a fixed xen package for your release, then upgrade and reboot.
Running Xen 4.16 or older: there is no patch. Plan an upgrade to a supported branch.
Why It Matters
Hypervisor escapes are rare and serious. This one is also another example of AI finding real bugs in core infrastructure: Anthropic credited its Claude model with the discovery, the same week an AI-found Linux kernel bug made headlines. Expect more of these, and expect the time between disclosure and attacks to keep shrinking. For homelabs, the takeaway is simple: patch the hypervisor, and actually reboot it.
Frequently Asked Questions
What is XSA-523?
A Xen security advisory published on November 3, 2026 for two flaws, CVE-2026-102703 and CVE-2026-102704, in grant copy, the mechanism Xen uses to copy data between virtual machines. A malicious guest can read and write the memory of other VMs on the same host, including dom0.
Which Xen versions are affected?
Xen 4.6 and later. Patches exist for xen-unstable and the 4.17 to 4.19 branches. Versions 4.6 to 4.16 get no patch from the Xen project.
Is there a workaround?
No. The advisory lists no mitigation, so updating and rebooting the host is the only fix.
Does this affect Proxmox or VirtualBox?
No. Proxmox uses KVM and VirtualBox has its own hypervisor. This advisory is only about the Xen hypervisor, which is used by XCP-ng, Qubes OS, Citrix Hypervisor and some cloud providers.
Who found it?
Anthropic credited its Claude model with finding the flaws. Stephan Lipp of Ada Logics validated them, and the CodeAnt AI Security Research Team reported the same issue independently.