# XSAs released on 2026-10-13

DevFeed: [XSAs released on 2026-10-13](<https://devfeed.tech/articles/xsas-released-on-2026-10-13-85901.md>)

Original publisher: [Read original article](<https://www.qubes-os.org/news/2026/10/13/xsas-released-on-2026-10-13/>)

Published: 2026-10-13T00:00:00Z

Content type: news

Language: en

Sources: [Qubes OS](<https://devfeed.tech/sources/qubes-os.md>)

Topics: [Xen](<https://devfeed.tech/topics/xen.md>), [Fedora Project Community](<https://devfeed.tech/topics/fedora-project-community.md>)

Tags: [security](<https://devfeed.tech/tags/security.md>), [security-advisories](<https://devfeed.tech/tags/security-advisories.md>), [security-advisory](<https://devfeed.tech/tags/security-advisory.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [xen](<https://devfeed.tech/tags/xen.md>), [xen-4-22](<https://devfeed.tech/tags/xen-4-22.md>)

## AI overview

The Xen Project released XSAs 514-521, and Qubes OS reports that none affect its security. The notice explains why each advisory does not apply, including differences in Xen versions, unused features, disabled grant tables, hardware requirements, and supported architectures. It says no user action is necessary.

## Source excerpt

The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is not affected. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: (none) XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-514: Affects only Xen 4.22 or higher; Qubes OS 4.3 uses Xen 4.19. Affects only Xenstore live update, which is not used in Qubes OS. XSA-515: Up-to-date systems are not affected. Only systems running outdated AMD microcode from before 2023 are affected. XSA-516: Only systems with 5 TiB of RAM or higher are affected, which is not the target hardware class for Qubes OS. XSA-517: Grant tables v2 are disabled at build time in Qubes OS. XSA-518: Denial of service only. In-VM only. XSA-519: ARM only. Qubes OS does not support ARM. XSA-520: Denial of service only. XSA-521: Tapdisk is not used in Qubes OS. About this announcement Qubes OS uses the Xen hypervisor as part of its architecture. When the Xen Project publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a Xen security advisory (XSA). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a Qubes security bulletin (QSB). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only positive confirmation that certain XSAs do affect the security of Qubes OS. QSBs cannot provide negative confirmation that other XSAs do not affect the security of Qubes OS. Therefore, we also maintain an XSA tracker, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security o