includes malicious HVM qubes with memory balancing enabled, as well as
templates and standalones that use in-qube kernels and that have memory
balancing enabled. The default Qubes OS configuration is not affected,
nor are commonly-used HVM qubes like Windows, since they don't have
memory balancing enabled.
Patching
---------
The following packages contain security updates that address the
vulnerabilities described in this bulletin:
For Qubes 4.3, in dom0:
- Xen packages, version 4.19.5-2
These packages will migrate from the security-testing repository to the
current (stable) repository over the next two weeks after being tested
by the community. [2] Once available, the packages should be installed
via the Qubes Update tool or its command-line equivalents. [1]
Dom0 must be restarted afterward in order for the updates to take
effect.
If you use Anti Evil Maid, you will need to reseal your secret
passphrase to new PCR values, as PCR18+19 will change due to the new Xen
binaries.
Credits
--------
See the original Xen Security Advisories. [3][4][5][6]
References
-----------
[1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html
[2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html
[3] https://xenbits.xen.org/xsa/advisory-500.html
[4] https://xenbits.xen.org/xsa/advisory-505.html
[5] https://xenbits.xen.org/xsa/advisory-506.html
[6] https://xenbits.xen.org/xsa/advisory-507.html
[7] A PV qube is a qube that is running with virt_mode set to "pv."
[8] For each qube that is running with virt_mode set to "hvm," there's a
small Xen-internal helper VM running alongside it, in which QEMU is
executed to provide device emulation for that qube. This helper VM
runs in PV mode and is called a "stubdomain."
--
The Qubes Security Team
https://www.qubes-os.org/security/
Source: qsb-116-2026.txt (https://github.com/QubesOS/qubes-secpack/blob/f9001423ffb11de26bdcf0b4478838739cc3f6b3/QSBs/qsb-116-2026.txt)
Marek Marczykowski-Górecki (https://www.qubes-os.org/team/#marek-marczykowski-g%C3%B3recki)’s PGP signature
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmpoeyMACgkQ1lWk8hgw
4GqUjw//brO4x3oOygOpewPqcjgYqohh4qPu5Dpm6JBvtxiIZQWEv9UZg0RqfMVc
omoalUCQhoTPu8QYnXu3HKo87LGcrUKKf2KeRx4CyT8LsZCQufA25uWD3Sr6eVsA
38Q/Znq3VyUpa5tMQm28JIIA9m2PMAMaXu5ElZVAw5kvcRncwRh8WDOrkVOO97ll
gSfBo3SJ0OfSUDcQvGa8f5+4Jx/SPoJn5zLo3Ott4tT7Tz2NAfE2Xlxl7karasY/
vCY+Lo8ACN+0ShELslGKYZnNdwLuwkz3lVN+FqDbLrHauBUjDLH7+yTXJvO9ZoXq
3LTpHopzv8oSJJyhq0YeO4XlKt+USn2HbIMqhJ9ON8aHHVE3/YhVJume4RuxSlHx
WAStN0bYH/NqSywYB3wWmGEho9wRw8bxLrOBIuZO3V63HpMJnCL412F7RFA2/9iS
muq3Iix9YpqfI/Q1Q18JSnYYLlWaphMtc/OJki5FAzp1B5DtQtPcQtg/vcy9tsrX
P9zrK4j3Dj/vPzZd6DwDmTBPxuiLQX79TQojl7NClVatkULfdHQGDKogfPmsJng9
IpKMBkMZ85QVv+DG/XFtXpynBdeg/6eTeWiexC7WF3HgILkhy2RadQz0eHsEwCmp
fIeVYQ2Es3eVH7aNaPHwaAcklNP+7yppgw5O81PGOlbD3Z9a15Y=
=vPOZ
-----END PGP SIGNATURE-----
Source: qsb-116-2026.txt.sig.marmarek (https://github.com/QubesOS/qubes-secpack/blob/f9001423ffb11de26bdcf0b4478838739cc3f6b3/QSBs/qsb-116-2026.txt.sig.marmarek)
Simon Gaiser (aka HW42) (https://www.qubes-os.org/team/#simon-gaiser-aka-hw42)’s PGP signature
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmpoh00ACgkQSsGN4REu
FJCSVhAApAdVntLjACF7SJ9h7SF4M1IiDKKUQRnUhwEa06d/qDjFg/aVlsL6LghW
+cKpPdjSDWwGPhAsJhbxTeiSSAkX300qJuqX3/K0h6iw7jaQkqb6kmwaAhK7J8Ym
9F5LvcP8Vvx3G0Gi4YogNzrwA+AMlfCgKLgp7MsHKumE1TY0pp5dI6DMqz2/EasV
ODrppsfXkMMmES5aR8C6Pxe51pfBbXVqVmffjYxaz/C9VvcfGbHja8OdnOuNeqmo
yzR2pP6BGdIl2KGfq1GzuuYWtitIcrG8aEnYfcmhiHbHkTIObNwHo7MOwBT2Q9H4
ALJfuBfC1ChBvmmzRIPgOzPbiz0MLIWcjFvKRmXW8azTTQOyRQQbG5lDGeu+aJm0
ZRdyXPQh2294MmmL3r+xtyFJTFw5WABdxjZa10nlB5B5JQ8FrV7koNc4quXhCS4U
ceAwpvCuRKTX1Lg+NDaPFtxAmYX98QkLT09V34vyqksOcMR+DY7stHol8T+hYIMM
8DXZDBdndUMkU/DU5xfj4Z/wtgkB66eLKBypxqibiPx33vkBZOIAYtNYK7zFnrTk
HnrHAGpm0sLlNdLzNA4XQ7yMTdDwzxW6GeYacYWxDT3t9Qc9vroGVju3CExQtljs
August 9, 2026 34
