Summary
It was discovered that libvirt had an integer overflow vulnerability in
the NodeGetFreePages RPC handler. A local attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2026-18917)
It was discovered that libvirt did not correctly handle symbolic links
when changing ownership of the TPM emulator log file. A local attacker
with access to the swtpm account could possibly use this issue to cause libvirt
to change the ownership of an arbitrary file. (CVE-2026-77159)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libvirt | 8.0.0-1ubuntu7.21 |
| Ubuntu · 24.04 LTS 24.04:LTS | libvirt | 10.0.0-2ubuntu8.19 |
| Ubuntu · 26.04 LTS 26.04:LTS | libvirt | 12.0.0-1ubuntu5.5 |
Vulnerabilities 2
-
High 7.8
Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUM…
-
Medium 5.5
Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile w…