From Qubes (via the mailing list, source is @rootkovska on birdsite):
"Re the #Meltdown/#Spectre attacks:
1. Practical impact on Qubes is unclear to us ATM,
2. No advanced info has been shared with us on Xen predisclosure list, so we've had no time to evaluate yet,
3. Xen published XSA 254 unexpectedly last night,
4. Xen offers no patches ATM"