Qubes OS and Xen hypervisor address critical security flaw

Qubes OS has issued security bulletin QSB-121 to address a critical vulnerability in the Xen hypervisor, identified as XSA-523. The flaw resides in Xen's grant copy optimization logic, where improper re-validation of cached data can lead to errors.

Specifically, the vulnerability allows a malicious qube to read and write arbitrary memory in other qubes and dom0. This issue includes two distinct CVEs: CVE-2026-102703, involving the swapping of frame numbers and grant references, and CVE-2026-102704, where frame-number copying bypasses necessary checks. Because the flaw breaks the core isolation principles of Qubes OS, all supported releases are affected.

In addition to the Qubes-specific issue, several Linux distributions, including Ubuntu, Red Hat, Oracle, and SUSE, have released security updates. These updates address various vulnerabilities, including critical fixes for the Pillow library and 31 new CVEs for curl, alongside various kernel updates.