The reality appears to be as you have stated (some CVEs that apply). https://news.ycombinator.com/item?id=10471912 https://news.ycombinator.com/item?id=1047191

The reality appears to be as you have stated (some CVEs that apply). https://news.ycombinator.com/item?id=10471912 https://news.ycombinator.com/item?id=10471912 https://raw.githubusercontent.com/QubesOS/qubes-secpack/master/QSBs/qsb-022-2015.txt https://raw.githubusercontent.com/QubesOS/qubes-secpack/mast... Because there have been, of course, many more security bugs found in Xen over the last years (as the numbering of this XSA suggests). True, majority of these didn't affect Qubes OS, sometimes by pure luck, sometimes because of the extra prudence we applied, many other times because of the architectural decisions we made.