XCP-ng 8.3 LTS: second batch of June 2026 updates

XCP-ng has released its second update batch of June 2026 for the 8.3 LTS branch. This is a maintenance release that pairs security patches with version bumps across several components. Because it touches the Xen hypervisor and the host kernel, every server needs a reboot once the update is applied.

Security fixes

On the Xen side, this batch closes two low-severity vulnerabilities:

• XSA-491 (CVE-2026-42487): an x86 HVM I/O port list traversal issue that could lead to denial of service and, in the worst case, privilege escalation.
• XSA-492 (CVE-2026-42489 and CVE-2026-42490): a domctl lock abuse that opened the door to denial of service.

Two other Xen advisories from the same cycle, XSA-493 (CVE-2025-10263) and XSA-494 (CVE-2026-42488), do not affect XCP-ng since it supports neither PV guests nor ARM CPUs.

There are also two fixes outside Xen:

• CVE-2026-46243: a flaw in the Linux kernel’s SMB filesystem driver that allowed privilege escalation.
• CVE-2026-46433: an out-of-bounds read in lldpd while processing VLAN tags.

If you run a Xen cluster and want the breakdown of this cycle’s XSA advisories, we cover it in Xen XSA-491 to 494: mapcache memory corruption.

Version bumps

The maintenance side brings package updates that matter depending on your hardware and storage setup:

• kmod-drbd 9.2.18: improves XOSTOR stability during host evacuation. If you run hyperconverged storage with XOSTOR, this is the change you’ll feel most.
• XAPI 26.1.11: fixes pool join issues, corrects VM migration, and adds DHCP support for IPv4 and IPv6.
• intel-ice 2.4.5: the Intel network driver now recognizes E825-C and E830 cards and adds link aggregation (LAG) support.
• mpi3mr 8.17.1: adds support for SAS5116 devices.
• Windows Guest Tools 9.1.200: a new release of the Windows guest tooling (xcp-ng-pv-tools).

Who should care

If you run XCP-ng servers in production, this batch is worth applying: it plugs privilege-escalation holes in the kernel and in lldpd, and the Xen patches, low severity as they are, are good to have. Anyone with Intel E825-C or E830 network cards, or SAS5116 controllers, gains hardware support that wasn’t there before.

For shops running large pools, the XAPI fixes around host join and VM migration cut down on surprises during maintenance. And if your homelab build uses XOSTOR, the DRBD bump alone makes it worthwhile.

The update goes through XCP-ng’s usual patch manager, and remember that all hosts must be rebooted for the hypervisor and kernel changes to take effect. Schedule the reboot with live migration of your VMs so you don’t drop service.

Source

June 2026 Updates #2 for XCP-ng 8.3 LTS — official XCP-ng blog.