Dear Qubes Community,
The [Xen Project](https://xenproject.org/) has released one or more [Xen security advisories (XSAs)](Xen Security Advisories).
The security of Qubes OS is *not* affected.
## XSAs that DO affect the security of Qubes OS
The following XSAs *do affect* the security of Qubes OS:
- (none)
## XSAs that DO NOT affect the security of Qubes OS
The following XSAs *do not affect* the security of Qubes OS, and no user action is necessary:
- [XSA-514](XSA-514 - Xen Security Advisories): Affects only Xen 4.22 or higher; Qubes OS 4.3 uses Xen 4.19. Affects only Xenstore live update, which is not used in Qubes OS.
- [XSA-515](XSA-515 - Xen Security Advisories): Up-to-date systems are not affected. Only systems running outdated AMD microcode from before 2023 are affected.
- [XSA-516](XSA-516 - Xen Security Advisories): Only systems with 5 TiB of RAM or higher are affected, which is not the target hardware class for Qubes OS.
- [XSA-517](XSA-517 - Xen Security Advisories): Grant tables v2 are disabled at build time in Qubes OS.
- [XSA-518](XSA-518 - Xen Security Advisories): Denial of service only. In-VM only.
- [XSA-519](XSA-519 - Xen Security Advisories): ARM only. Qubes OS does not support ARM.
- [XSA-520](XSA-520 - Xen Security Advisories): Denial of service only.
- [XSA-521](XSA-521 - Xen Security Advisories): Tapdisk is not used in Qubes OS.
## About this announcement
Qubes OS uses the [Xen hypervisor](Making sure you're not a bot!) as part of its [architecture](Architecture — Qubes OS 4.3.1 documentation). When the [Xen Project](https://xenproject.org/) publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a [Xen security advisory (XSA)](Security policy | Xen Project). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a [Qubes security bulletin (QSB)](Qubes security bulletins (QSBs) | Qubes OS). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only *positive* confirmation that certain XSAs *do* affect the security of Qubes OS. QSBs cannot provide *negative* confirmation that other XSAs do *not* affect the security of Qubes OS. Therefore, we also maintain an [XSA tracker](Xen security advisory (XSA) tracker | Qubes OS), which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.
This announcement is also available on the Qubes website: