One compromised VM can read and write every other VM’s memory on a Xen host, including dom0

On November 3, 2026, the Xen Project published XSA-523: two flaws in the grant copy operation let a malicious virtual machine read and write the memory of other domains, including dom0. There is no mitigation; apply the patches and reboot your XCP-ng, Qubes OS, and Xen hosts as soon as they land.