Xen Grant Copy Flaws Allow Cross-Domain Memory Access, Affecting All Supported Qubes Releases

The Xen Project released XSA-523 version 2, disclosing two Grant Copy vulnerabilities, CVE-2026-102703 and CVE-2026-102704, that allow a malicious guest to read and write arbitrary memory belonging to other domains, including Dom0. Incorrect revalidation of cached data and a misplaced access check undermine isolation between guests and the privileged management domain. Xen versions 4.6 onward are vulnerable; versions 4.5 and earlier are unaffected. The advisory provides patches for xen-unstable and Xen 4.17.x through 4.19.x, and states that no mitigation is known. The supplied references do not establish active exploitation.

Qubes OS confirmed in QSB-121 that all supported releases and configurations are affected: a malicious qube could access or modify memory belonging to other qubes or dom0. For Qubes OS 4.3, the bulletin identifies Xen packages version 4.19.6-3 in dom0 as the fix, with promotion from security-testing to the stable repository planned over the following two weeks after community testing. Users must install the updates and restart dom0. Anti Evil Maid users must also reseal their secret passphrase because the updated Xen binaries change PCR18 and PCR19. Administrators should consult QSB-121 for applicable update instructions rather than assume fixes are already available in the stable repository.