Qubes Issues Xen Update for AMD IOMMU and Transient Scheduler Vulnerabilities

Qubes OS has issued QSB-123 for AMD CPU vulnerabilities covered by Xen advisories XSA-524 and XSA-525. XSA-524 concerns an IOMMU out-of-bounds device-table read that could enable arbitrary memory writes, potentially allowing a malicious qube to compromise Qubes OS on certain AMD EPYC systems. XSA-525 updates Transient Scheduler Attack findings that could allow a malicious qube to leak data from other qubes. AMD corrected its earlier assessment that Zen 5 CPUs were unaffected by TSA-SQ and TSA-L1, tracked as CVE-2024-36350 and CVE-2024-36357. The advisory also introduces TSA-Fill, tracked as CVE-2026-0004; a subsequent Xen mailing-list correction identifies its AMD bulletin as AMD-SB-3055, not AMD-SB-3031. Intel CPUs are unaffected by both advisories.

Qubes 4.3 users should install Xen package version 4.19.6-4 in dom0 and restart dom0 afterward. Anti Evil Maid users must also reseal their secret passphrase because the Xen update changes PCR18 and PCR19 values. Qubes directs users to QSB-123 for remediation of both AMD advisories. Among the accompanying Xen disclosures, XSA-529 and XSA-530 do not affect Qubes because it does not use XAPI, while Qubes classifies the denial-of-service-only XSA-531 as non-impacting. The security team is still investigating XSA-532 and will update its announcement and tracker when the impact is determined.