Analysis of the Public Security Record for Qubes OS

Author: Alfonso De Gregorio
Submission Date: July 16, 2026
Archive Reference: arXiv:2607.14587 [cs.CR]
Categories: Cryptography and Security (cs.CR), Computation and Language (cs.CL)

---

Executive Summary

Qubes OS serves as a prime subject for security measurement because its architectural design renders the boundaries between various components security-critical. This research provides a longitudinal, protocol-driven examination of the public security record associated with the OS.

Crucial Distinction: This study focuses exclusively on the public advisory record. It does not measure the actual incidence of latent vulnerabilities or the frequency of realized system compromises.

Data Sources

The analysis is derived from three primary streams:

1. QSBs: 109 official Qubes Security Bulletins spanning the years 2011–2025.
2. XSA Tracker: The official Xen Security Advisory tracker maintained by Qubes.
3. Sensitivity Series: A secondary series focused on vulnerability-event sensitivity.

---

Methodology & Technical Approach

The researcher employed a rigorous set of analytical tools to ensure the validity of the findings. The following checklist represents the methodological framework:

• Deterministic Component Attribution: Audited mapping of vulnerabilities to specific components.
• Change-Point Analysis: Identification of significant shifts in disclosure trends.
• Overdispersion Checks: Ensuring statistical models account for variance.
• Severity-Proxy Weighting: Adjusting the impact of advisories based on severity.
• Censoring Sensitivity: Accounting for missing or hidden data.
• Documentary Latency: Establishing lower bounds for the time between discovery and disclosure.
• VDM Evaluation: Testing Vulnerability Discovery Models against a baseline.

Mathematical Context

The study utilizes Poisson inferences to analyze disclosure rates, ensuring stability via negative-binomial sensitivity checks. The relationship between discovery and time can be modeled as: $\text{Discovery Rate} \approx f(\text{Time, Component Complexity, Audit Intensity})$

---

Key Findings

1. Upstream Dependency

The data reveals a heavy reliance on external "trust anchors." The vast majority of security issues are not rooted in the core logic of Qubes itself, but in the components it integrates.

Attribution Breakdown:

2. Temporal Trends

The study identified a specific "break" in the data:

• The Pivot: 2015Q1 was identified as the dominant change-point in the quarterly series.
• The Plateau: From 2018 onwards, the annual rate of disclosures has remained statistically flat.

3. Model Performance

The researchers tested S-shaped Vulnerability Discovery Models (VDMs). While these models provide a good descriptive fit for the historical data, they failed to significantly outperform a simple rolling-mean baseline when attempting short-horizon forecasts.

---

Final Conclusion

The public security record of Qubes OS is characterized as stable, but not silent. While the frequency of disclosures has plateaued at a higher rate than seen in the project's infancy, the primary security burden continues to reside within upstream dependencies rather than the internal Qubes architecture.

Document Metadata

• Length: 18 pages
• Visuals: 3 figures, 4 tables
• Open Data: Dataset bundle available via Zenodo
• License:

---

Links: View PDF | HTML Experimental | TeX Source