CVE-2026-63622

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.(CVE-2026-63622)

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.(CVE-2026-63622)

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.(CVE-2026-63622)

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.(CVE-2026-63622)

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.(CVE-2026-63622)

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.(CVE-2026-63623)

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

• libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

• libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917)

Bug Fix(es) and Enhancement(s):

• Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [rhel-9.8.z] (JIRA:Rocky Linux-186018)

• libvirt-guests does not work together with virtlockd on shutdown [rhel-9.8.z] (JIRA:Rocky Linux-224986)

• Expose guest-get-devices in libvirt-api [rhel-9.8.z] (JIRA:Rocky Linux-243306)

• allow hyperv pvpanic "device" to process Windows crash dump [rhel-9.8.z] (JIRA:Rocky Linux-242549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

• libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

• libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917)

Bug Fix(es) and Enhancement(s):

• Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [rhel-10.2.z] (JIRA:Rocky Linux-186019)

• virsh dumpxml missing one SCSI disk when VMware VM has 64 disks per controller [rhel-10.2.z] (JIRA:Rocky Linux-191267)

• libvirt-guests does not work together with virtlockd on shutdown [rhel-10.2.z] (JIRA:Rocky Linux-224982)

• Expose guest-get-devices in libvirt-api [rhel-10.2.z] (JIRA:Rocky Linux-243305)

• allow hyperv pvpanic "device" to process Windows crash dump [rhel-10.2.z] (JIRA:Rocky Linux-242547)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

• libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)
• libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917)

Bug Fix(es) and Enhancement(s):

• Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-9.8.z] (JIRA:AlmaLinux-186018)
• libvirt-guests does not work together with virtlockd on shutdown [almalinux-9.8.z] (JIRA:AlmaLinux-224986)
• Expose guest-get-devices in libvirt-api [almalinux-9.8.z] (JIRA:AlmaLinux-243306)
• allow hyperv pvpanic "device" to process Windows crash dump [almalinux-9.8.z] (JIRA:AlmaLinux-242549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

• libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)
• libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917)

Bug Fix(es) and Enhancement(s):

• Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-10.2.z] (JIRA:AlmaLinux-186019)
• virsh dumpxml missing one SCSI disk when VMware VM has 64 disks per controller [almalinux-10.2.z] (JIRA:AlmaLinux-191267)
• libvirt-guests does not work together with virtlockd on shutdown [almalinux-10.2.z] (JIRA:AlmaLinux-224982)
• Expose guest-get-devices in libvirt-api [almalinux-10.2.z] (JIRA:AlmaLinux-243305)
• allow hyperv pvpanic "device" to process Windows crash dump [almalinux-10.2.z] (JIRA:AlmaLinux-242547)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.

• CVE-2026-63622: do not follow symlinks in virFileChownFiles
• CVE-2026-18917: fix integer overflow in virNodeGetFreePages RPC handler

• CVE-2026-18917: fix integer overflow in the npages * cellcount size check in remoteDispatchNodeGetFreePages
• CVE-2026-63622: do not follow symlinks in virFileChownFiles

This update for libvirt fixes the following issues:

• CVE-2026-18917: integer overflow in NodeGetFreePages RPC handler leads to heap buffer overflow and allows for possible local privilege escalation (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for dnsmasq configuration directive injection and can lead to arbitrary code execution as root (bsc#1274576).
• CVE-2026-63622: symlink-following in virFileChownFiles() allows swtpm user to trick the root-level libvirt daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).
• CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can lead to sensitive information disclosure (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks and allows for root-owned file ownership changes, which can lead to privilege escalation (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

Changes for libvirt:

• rpc: avoid leak of GSource in use for interrupting main loop bsc#1258345

This update for libvirt fixes the following issues:

• CVE-2026-18917: integer overflow in NodeGetFreePages RPC handler leads to heap buffer overflow and allows for possible local privilege escalation (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for dnsmasq configuration directive injection and can lead to arbitrary code execution as root (bsc#1274576).
• CVE-2026-63622: symlink-following in virFileChownFiles() allows swtpm user to trick the root-level libvirt daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).
• CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can lead to sensitive information disclosure (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks and allows for root-owned file ownership changes, which can lead to privilege escalation (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: integer overflow in NodeGetFreePages RPC handler leads to heap buffer overflow and allows for possible local privilege escalation (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for dnsmasq configuration directive injection and can lead to arbitrary code execution as root (bsc#1274576).
• CVE-2026-63622: symlink-following in virFileChownFiles() allows swtpm user to trick the root-level libvirt daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).
• CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can lead to sensitive information disclosure (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks and allows for root-owned file ownership changes, which can lead to privilege escalation (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: remote: Fix integer overflow in RPC handler for virNodeGetFreePages (bsc#1275863)
• CVE-2026-63622: util: virFileChownFiles: do not follow symlinks (bsc#1275264)
• CVE-2026-63623: storage: create images with a private umask during qemu-img create/convert (bsc#12075265)
• CVE-2026-77159: qemu: tpm: Avoid following symlinks when chown'ing log file (bsc#1274946)
• CVE-2026-61477: Reject line breaks in network config (bsc#1274576)
• qemu: Fix invocation of numa-preplace when hugepages requested, but page size not specified (bsc#1266364)
• Add ClearwaterForest CPU model (jsc#PED-16192)

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

It was discovered that libvirt incorrectly handled guest reboots in the libxl driver. An attacker in a guest could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2021-4147)

Alexander Kuznetsov discovered that libvirt incorrectly handled listing network interfaces. An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-1441)

It was discovered that libvirt incorrectly handled certain values in its RPC library. An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-2494)

It was discovered that libvirt incorrectly handled listing network interfaces under certain circumstances. An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-2496)

It was discovered that libvirt incorrectly set permissions on external inactive snapshots, making them world-readable. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-13193)

It was discovered that libvirt incorrectly handled certain characters in virtual network definitions. An authenticated user could possibly use this issue to inject arbitrary configuration directives and execute arbitrary code as root. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61477)

It was discovered that libvirt incorrectly handled certain XML input. An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. (CVE-2026-61478)

He Wei discovered that libvirt incorrectly followed symbolic links when changing file ownership. A local attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63622)

It was discovered that libvirt incorrectly set permissions on images during storage volume clone and convert operations, making them temporarily world-readable. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-63623)

It was discovered that libvirt did not properly validate newline characters in DNS TXT record values and SRV record attributes in its virtual network driver. A local attacker with permission to define virtual networks could possibly use this issue to inject arbitrary dnsmasq configuration directives, leading to arbitrary command execution as root. (CVE-2026-61477)

It was discovered that libvirt did not properly handle errors during XML context parsing. An attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2026-61478)

He Wei discovered that libvirt had a symlink-following vulnerability in the file ownership change function used for virtual TPM state directories. A local attacker running as the swtpm user could possibly use this issue to cause libvirt to change the ownership of an arbitrary file, leading to privilege escalation. (CVE-2026-63622)

It was discovered that libvirt created storage volume images with overly permissive permissions during clone or convert operations. A local attacker could possibly use this issue to read guest disk contents, resulting in information disclosure. (CVE-2026-63623)

It was discovered that libvirt had an integer overflow in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue to cause libvirt to crash or execute arbitrary code. (CVE-2026-18917)

It was discovered that libvirt had a symlink-following flaw in the virtual TPM emulator setup function. A local attacker with access to the swtpm account could possibly use this issue to cause libvirt to change the ownership of an arbitrary file, leading to privilege escalation. (CVE-2026-77159)