Unknown kernel parameter

Tranquility · April 22, 2026, 12:02am

Greetings.

Recently i came across some unknown kernel parameter exist within my qubes os desktop installation. Specifically, ‘xen_privcmd.unrestricted’.

I had searched google and i found out recent security vulnerability, disclosed, in google. This is the link :
https://access.redhat.com/security/cve/cve-2026-31788

I hope i can figure out the answer for this problems.

phceac · April 22, 2026, 4:00am

It seems like it comes from a recent update:

github.com/QubesOS/qubes-issues

Arch Linux VMs with 6.19.10 in-VM kernel fail to boot due to xen_privcmd lockdown

opened 12:42AM - 30 Mar 26 UTC

closed 11:28AM - 06 Apr 26 UTC

SaswatPadhi

C: kernel C: Xen C: Arch Linux P: default diagnosed affects-4.3 community template r4.3-vm-bookworm-stable r4.3-stable r4.3-vm-trixie-stable r4.3-host-stable r4.3-vm-fc41-stable r4.3-vm-fc42-stable r4.3-vm-fc43-stable devel-host-cur-test devel-vm-fc42-cur-test devel-vm-fc43-cur-test devel-vm-fc41-cur-test devel-vm-bookworm-cur-test devel-vm-trixie-cur-test devel-vm-fc44-cur-test r4.3-vm-fc44-stable devel-vm-archlinux-cur-test

### Qubes OS release R4.3 ### Brief summary Arch Linux VMs using an in-VM ker…nel fail to initialize Qubes services after a recent kernel upgrade. The update includes the Xen XSA-482 (CVE-2026-31788) security patch, which aggressively locks down the xen_privcmd driver. The VM gets stuck during boot, on starting `qubes-early-vm-config.service`, and eventually times out. ### Steps to reproduce 1. In Dom0: Create an Arch Linux AppVM using the community template. 2. In AppVM: pull the latest `linux` kernel (I am running `6.19.10-arch1`) and follow the steps to enable booting with in-VM kernel: `pacman -S qubes-vm-kernel-support`, `grub-install`, `grub-mkconfig` etc. Shutdown the VM. 3. In Dom0: configure the AppVM to boot using in-VM kernel: `qvm-prefs <vm_name> kernel ""` and `qvm-prefs <vm_name> virt_mode hvm`. 4. In Dom0: `qvm-start <vm_name>` ### Expected behavior The VM boots normally. ### Actual behavior The VM starts but appears to hang indefinitely from Dom0's perspective (no GUI, qrexec times out). When observing the boot process via `qvm-prefs <vm_name> debug true`, the kernel successfully loads and mounts the root filesystem, but `dmesg` shows `xen_privcmd: No target domain found blocking all hypercalls` ### Additional information **Workaround:** Appending `xen_privcmd.unrestricted=1` to the `GRUB_CMDLINE_LINUX_DEFAULT` string in `/etc/default/grub` inside the VM resolves the issue. This bypasses the new lockdown behavior and allows hypercalls to function normally again.

It is decribed a little bit there.