Skip to content
OpenAdvisories

Description

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support — —
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support — —
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — —
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On — —
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support — —
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On — —
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service — —
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions — —
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions — —
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux for NVIDIA 26 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libvirt 12.7.0-1 —
Debian 13 libvirt 11.3.0-3+deb13u3 —
Debian 12 libvirt No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS libvirt +1 12.0.0-1ubuntu5.5 USN-8833-1, USN-8831-1
Ubuntu 24.04 LTS libvirt 10.0.0-2ubuntu8.19 USN-8831-1
Ubuntu 22.04 LTS libvirt 8.0.0-1ubuntu7.21 USN-8831-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libvirt No fix yet —
Ubuntu Pro 18.04 LTS libvirt No fix yet —
Ubuntu Pro 16.04 LTS libvirt No fix yet —
Ubuntu Pro 14.04 LTS libvirt No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 libvirt +31 11.10.0-12.9.el10_2 RHSA-2026:75583
RHEL 9 libvirt +31 11.10.0-12.7.el9_8 RHSA-2026:74424
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS libvirt +31 10.10.0-8.12.el10_0 RHSA-2026:68510
RHEL 9.6 EUS libvirt +31 10.10.0-7.19.el9_6 RHSA-2026:68511
RHEL 9.4 E4S libvirt +27 10.0.0-6.24.el9_4 RHSA-2026:68509
RHEL 9.2 E4S libvirt +21 9.0.0-10.17.el9_2 RHSA-2026:68514
RHEL 8.8 TUS hivex +3 1.3.18-23.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libguestfs +20 1:1.44.0-9.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libguestfs-winsupport 8.8-2.module+el8.8.0+19817+dd5e62f6 RHSA-2026:68513
RHEL 8.8 TUS libiscsi +2 1.18.0-8.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libnbd +4 1.6.0-5.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libtpms +1 0.9.1-3.20211126git1ff6fe1f43.module+el8.8.0+23328+ce46509e RHSA-2026:68513
RHEL 8.8 TUS libvirt +27 8.0.0-19.4.module+el8.8.0+24859+5ac274d4 RHSA-2026:68513
RHEL 8.8 TUS libvirt-dbus 1.3.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libvirt-python +1 8.0.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS nbdkit +18 1.24.0-5.module+el8.8.0+17308+05924798 RHSA-2026:68513
RHEL 8.8 TUS netcf +2 0.2.8-12.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS perl-Sys-Virt 8.0.0-1.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS qemu-img +9 15:6.2.0-33.module+el8.8.0+23656+9936300e.7 RHSA-2026:68513
RHEL 8.8 E4S SLOF 20210217-2.module+el8.8.0+20737+daad9f3b RHSA-2026:68513
RHEL 8.8 E4S hivex +4 1.3.18-23.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S libguestfs-winsupport 8.8-2.module+el8.8.0+19817+dd5e62f6 RHSA-2026:68513
RHEL 8.8 E4S libiscsi +2 1.18.0-8.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S libnbd +4 1.6.0-5.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S libtpms +1 0.9.1-3.20211126git1ff6fe1f43.module+el8.8.0+23328+ce46509e RHSA-2026:68513
RHEL 8.8 E4S libvirt +27 8.0.0-19.4.module+el8.8.0+24859+5ac274d4 RHSA-2026:68513
RHEL 8.8 E4S libvirt-dbus 1.3.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S libvirt-python +1 8.0.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S nbdkit +18 1.24.0-5.module+el8.8.0+17308+05924798 RHSA-2026:68513
RHEL 8.8 E4S netcf +2 0.2.8-12.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S perl-Sys-Virt 8.0.0-1.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S qemu-img +13 15:6.2.0-33.module+el8.8.0+23656+9936300e.7 RHSA-2026:68513
RHEL 8.8 E4S seabios +2 1.16.0-4.module+el8.8.0+19627+2d14cb21 RHSA-2026:68513
RHEL 8.8 E4S sgabios +1 1:0.20170427git-3.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S supermin +1 5.2.1-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S swtpm +4 0.7.0-4.20211109gitb79fd91.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S virt-dib +22 1:1.44.0-9.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S virt-v2v +3 1:1.42.0-22.module+el8.8.0+19067+b66cdac6 RHSA-2026:68513
RHEL 8.6 EUS Long Life SLOF 20210217-1.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life hivex +3 1.3.18-23.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libguestfs +20 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libguestfs-winsupport 8.6-2.module+el8.6.0+19818+47334628 RHSA-2026:68594
RHEL 8.6 EUS Long Life libiscsi +2 1.18.0-8.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libnbd +4 1.6.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libtpms +1 0.9.1-2.20211126git1ff6fe1f43.module+el8.6.0+23331+44040c55 RHSA-2026:68594
RHEL 8.6 EUS Long Life libvirt +27 8.0.0-5.12.module+el8.6.0+24861+997f960b RHSA-2026:68594
RHEL 8.6 EUS Long Life libvirt-dbus 1.3.0-2.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libvirt-python +1 8.0.0-1.1.module+el8.6.0+16381+3abc475c RHSA-2026:68594
RHEL 8.6 EUS Long Life nbdkit +18 1.24.0-4.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life netcf +2 0.2.8-12.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life perl-Sys-Virt 8.0.0-1.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life qemu-img +9 15:6.2.0-11.module+el8.6.0+23680+701901c8.17 RHSA-2026:68594
RHEL 8.6 AUS hivex +4 1.3.18-23.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS libguestfs-winsupport 8.6-2.module+el8.6.0+19818+47334628 RHSA-2026:68594
RHEL 8.6 AUS libiscsi +2 1.18.0-8.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS libnbd +4 1.6.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS libtpms +1 0.9.1-2.20211126git1ff6fe1f43.module+el8.6.0+23331+44040c55 RHSA-2026:68594
RHEL 8.6 AUS libvirt +27 8.0.0-5.12.module+el8.6.0+24861+997f960b RHSA-2026:68594
RHEL 8.6 AUS libvirt-dbus 1.3.0-2.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS libvirt-python +1 8.0.0-1.1.module+el8.6.0+16381+3abc475c RHSA-2026:68594
RHEL 8.6 AUS nbdkit +18 1.24.0-4.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS netcf +2 0.2.8-12.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS perl-Sys-Virt 8.0.0-1.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS qemu-img +13 15:6.2.0-11.module+el8.6.0+23680+701901c8.17 RHSA-2026:68594
RHEL 8.6 AUS seabios +2 1.15.0-2.module+el8.6.0+19580+39804e41.1 RHSA-2026:68594
RHEL 8.6 AUS sgabios +1 1:0.20170427git-3.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS supermin +1 5.2.1-1.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS swtpm +4 0.7.0-3.20211109gitb79fd91.module+el8.6.0+16156+d5629340 RHSA-2026:68594
RHEL 8.6 AUS virt-dib +22 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS virt-v2v +3 1:1.42.0-19.module+el8.6.0+15577+2ffd6ffa RHSA-2026:68594
RHEL 8.4 EUS Long Life SLOF 20191022-3.git899d9883.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 EUS Long Life hivex +4 1.3.18-21.module+el8.4.0+10770+19c037f9 RHSA-2026:69131
RHEL 8.4 EUS Long Life libguestfs-winsupport 8.4-1.module+el8.4.0+19830+486a2a6d RHSA-2026:69131
RHEL 8.4 EUS Long Life libiscsi +2 1.18.0-8.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 EUS Long Life libnbd +3 1.2.2-1.module+el8.3.0+7353+9de0a3cc RHSA-2026:69131
RHEL 8.4 EUS Long Life libvirt +28 6.0.0-35.6.module+el8.4.0+24887+5ada1549 RHSA-2026:69131
RHEL 8.4 EUS Long Life libvirt-dbus 1.3.0-2.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 EUS Long Life nbdkit +13 1.16.2-4.module+el8.3.0+6922+fd575af8 RHSA-2026:69131
RHEL 8.4 EUS Long Life netcf +2 0.2.8-12.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 EUS Long Life perl-Sys-Virt +2 6.0.0-1.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 EUS Long Life qemu-img +9 15:4.2.0-49.module+el8.4.0+23681+5ef782f9.12 RHSA-2026:69131
RHEL 8.4 EUS Long Life seabios +2 1.13.0-2.module+el8.3.0+7353+9de0a3cc RHSA-2026:69131
RHEL 8.4 EUS Long Life sgabios +1 1:0.20170427git-3.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 EUS Long Life supermin +1 5.1.19-10.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 EUS Long Life virt-dib +23 1:1.40.2-27.module+el8.4.0+9282+0bdec052 RHSA-2026:69131
RHEL 8.4 AUS hivex +4 1.3.18-21.module+el8.4.0+10770+19c037f9 RHSA-2026:69131
RHEL 8.4 AUS libguestfs-winsupport 8.4-1.module+el8.4.0+19830+486a2a6d RHSA-2026:69131
RHEL 8.4 AUS libiscsi +2 1.18.0-8.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 AUS libnbd +3 1.2.2-1.module+el8.3.0+7353+9de0a3cc RHSA-2026:69131
RHEL 8.4 AUS libvirt +28 6.0.0-35.6.module+el8.4.0+24887+5ada1549 RHSA-2026:69131
RHEL 8.4 AUS libvirt-dbus 1.3.0-2.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 AUS nbdkit +13 1.16.2-4.module+el8.3.0+6922+fd575af8 RHSA-2026:69131
RHEL 8.4 AUS netcf +2 0.2.8-12.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 AUS perl-Sys-Virt +2 6.0.0-1.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 AUS qemu-img +9 15:4.2.0-49.module+el8.4.0+23681+5ef782f9.12 RHSA-2026:69131
RHEL 8.4 AUS seabios +2 1.13.0-2.module+el8.3.0+7353+9de0a3cc RHSA-2026:69131
RHEL 8.4 AUS sgabios +1 1:0.20170427git-3.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 AUS supermin +1 5.1.19-10.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 AUS virt-dib +23 1:1.40.2-27.module+el8.4.0+9282+0bdec052 RHSA-2026:69131
RHEL 7 ELS libvirt +30 4.5.0-36.el7_9.7 RHSA-2026:69114

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 libvirt +31 11.10.0-12.9.el10_2.alma.1 ALSA-2026:75583
AlmaLinux 9 libvirt +31 11.10.0-12.7.el9_8.alma.1 ALSA-2026:74424

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 libvirt 11.10.0-12.9.el10_2 RLSA-2026:75583
Rocky Linux 9 libvirt 11.10.0-12.7.el9_8 RLSA-2026:74424
ReleasePackageFixed inAdvisory
SLES 15 SP7 libvirt 11.0.0-150700.4.27.1 SUSE-SU-2026:3939-1
SLES 15 SP6 libvirt 10.0.0-150600.8.18.1 SUSE-SU-2026:4010-1
SLES 15 SP5 libvirt 9.0.0-150500.6.29.1 SUSE-SU-2026:4009-1
SLES 15 SP4 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
SLES 12 SP5 libvirt 5.1.0-13.48.1 SUSE-SU-2026:4141-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 libvirt 11.4.0-160000.5.1 SUSE-SU-2026:23603-1
SLES for SAP 15 SP6 libvirt 10.0.0-150600.8.18.1 SUSE-SU-2026:4010-1
SLES for SAP 15 SP5 libvirt 9.0.0-150500.6.29.1 SUSE-SU-2026:4009-1
SLES for SAP 15 SP4 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
SLES 16.0 libvirt 11.4.0-160000.5.1 SUSE-SU-2026:23603-1
SLE Micro 6.2 libvirt 11.4.0-160000.5.1 SUSE-SU-2026:23460-1
SLE Micro 6.1 libvirt 10.0.0-slfo.1.1_3.1 SUSE-SU-2026:23515-1
SLE Micro 6.0 libvirt 10.0.0-5.1 SUSE-SU-2026:23445-1
SLE Micro 5.5 libvirt 9.0.0-150500.6.29.1 SUSE-SU-2026:4009-1
SLE Micro 5.4 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
SLE Micro 5.3 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
SLE HPC 15 SP5 libvirt 9.0.0-150500.6.29.1 SUSE-SU-2026:4009-1
SLE HPC 15 SP4 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libvirt 12.6.0-2.1 openSUSE-SU-2026:11622-1
openSUSE Leap 16.0 libvirt 11.4.0-160000.5.1 openSUSE-SU-2026:21738-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libvirt +27 12.0.0-3.amzn2023.0.2 ALAS2023-2026-2139
Amazon Linux 2 libvirt +30 4.5.0-36.amzn2.3.4 ALAS2-2026-3910

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libvirt 11.9.0-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 libvirt +31 11.10.0-12.9.0.1.el10_2 ELSA-2026-75583
Oracle Linux 9 libvirt +31 11.10.0-12.7.0.1.el9_8 ELSA-2026-74424

Advisories 32

References