QSB-121: Arbitrary read/write via grant copy (XSA-523)

The Qubes OS Project has published Qubes Security Bulletin 121 addressing Xen Security Advisory XSA-523, which involves arbitrary read and write vulnerabilities via grant copy operations. All supported Qubes OS releases and configurations are affected by these issues, tracked as CVE-2026-102703 and CVE-2026-102704. To resolve the vulnerabilities, users must update dom0 packages to Xen version 4.19.6-3 and restart dom0. Open article →