# QSB-116: Multiple Xen issues (XSA-500, XSA-505, XSA-506, XSA-507)

DevFeed: [QSB-116: Multiple Xen issues (XSA-500, XSA-505, XSA-506, XSA-507)](<https://devfeed.tech/articles/qsb-116-multiple-xen-issues-xsa-500-xsa-505-xsa-506-xsa-507-47152.md>)

Original publisher: [Read original article](<https://www.qubes-os.org/news/2026/07/28/qsb-116/>)

Published: 2026-07-28T00:00:00Z

Content type: news

Language: en

Sources: [Qubes OS](<https://devfeed.tech/sources/qubes-os.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Xen](<https://devfeed.tech/topics/xen.md>), [Security](<https://devfeed.tech/topics/security.md>), [digital signature](<https://devfeed.tech/topics/digital-signature.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [standard](<https://devfeed.tech/topics/standard.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [announcement](<https://devfeed.tech/tags/announcement.md>), [command-line](<https://devfeed.tech/tags/command-line.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [digital-signature](<https://devfeed.tech/tags/digital-signature.md>), [linux](<https://devfeed.tech/tags/linux.md>), [patching](<https://devfeed.tech/tags/patching.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [signing](<https://devfeed.tech/tags/signing.md>), [standard](<https://devfeed.tech/tags/standard.md>), [xen](<https://devfeed.tech/tags/xen.md>)

## AI overview

Qubes Security Bulletin 116 reports four Xen security issues: a grant-table type confusion, a race involving FIFO event channels, insufficient buffer checks in DM_OP hypercalls, and an issue involving special pages with Populated on Demand. Users are instructed to continue normal updates to receive the security fixes. The bulletin also explains how to authenticate it using accompanying PGP signatures.

## Source excerpt

We have published Qubes Security Bulletin (QSB) 116: Multiple Xen issues (XSA-500, XSA-505, XSA-506, XSA-507). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 116 ---===[ Qubes Security Bulletin 116 ]===--- 2026-07-28 Multiple Xen issues (XSA-500, XSA-505, XSA-506, XSA-507) User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2026-07-28, the Xen Project published the security advisories below. XSA-500 [3] "grant-table: type confusion in grant-copy": | When grant-copy operations are processed, the respective grant may or | may not already be in use by another operation (a mapping or another | copy). For all copy operations the referenced guest frame is looked | up. When another operation is already active for the grant (the grant | is "pinned"), what is being supplied back to actually carry out | permission checks and copy operation may not be consistent: The | permission check may be carried out on a page different from the one | involved in the copy. XSA-505 [4] "evtchn: Race between FIFO expand and reset": | The EVTCHNOP_expand_array hypercall checks for whether FIFO event | channels are enabled, but without holding the correct lock. It can | race with EVTCHNOP_reset, resulting in deferencing a NULL pointer. XSA-506 [5] "correct buffer checks for DM_OP hypercalls": | Parts of the DM_OP handling code assumes the caller has provided the | required number of buffers for the given operation without any | checking being done. As a result, certain operations might access | stack rubble as structures are possibly uninitialized. XSA-507 [6] "PoD: Don't try to reclaim special pages": | A guest started with Populated on Demand enabled (PoD) can attempt to | rec