CVE-2026-77159

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.(CVE-2026-77159)

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

These are all security issues fixed in the libvirt-12.6.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libvirt fixes the following issues:

• CVE-2026-18917: integer overflow in NodeGetFreePages RPC handler leads to heap buffer overflow and allows for possible local privilege escalation (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for dnsmasq configuration directive injection and can lead to arbitrary code execution as root (bsc#1274576).
• CVE-2026-63622: symlink-following in virFileChownFiles() allows swtpm user to trick the root-level libvirt daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).
• CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can lead to sensitive information disclosure (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks and allows for root-owned file ownership changes, which can lead to privilege escalation (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

Changes for libvirt:

• rpc: avoid leak of GSource in use for interrupting main loop bsc#1258345

This update for libvirt fixes the following issues:

• CVE-2026-18917: integer overflow in NodeGetFreePages RPC handler leads to heap buffer overflow and allows for possible local privilege escalation (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for dnsmasq configuration directive injection and can lead to arbitrary code execution as root (bsc#1274576).
• CVE-2026-63622: symlink-following in virFileChownFiles() allows swtpm user to trick the root-level libvirt daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).
• CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can lead to sensitive information disclosure (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks and allows for root-owned file ownership changes, which can lead to privilege escalation (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: integer overflow in NodeGetFreePages RPC handler leads to heap buffer overflow and allows for possible local privilege escalation (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for dnsmasq configuration directive injection and can lead to arbitrary code execution as root (bsc#1274576).
• CVE-2026-63622: symlink-following in virFileChownFiles() allows swtpm user to trick the root-level libvirt daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).
• CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can lead to sensitive information disclosure (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks and allows for root-owned file ownership changes, which can lead to privilege escalation (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: remote: Fix integer overflow in RPC handler for virNodeGetFreePages (bsc#1275863)
• CVE-2026-63622: util: virFileChownFiles: do not follow symlinks (bsc#1275264)
• CVE-2026-63623: storage: create images with a private umask during qemu-img create/convert (bsc#12075265)
• CVE-2026-77159: qemu: tpm: Avoid following symlinks when chown'ing log file (bsc#1274946)
• CVE-2026-61477: Reject line breaks in network config (bsc#1274576)
• qemu: Fix invocation of numa-preplace when hugepages requested, but page size not specified (bsc#1266364)
• Add ClearwaterForest CPU model (jsc#PED-16192)

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

This update for libvirt fixes the following issues:

• CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
• CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
• CVE-2026-63622: swtpm privilege escalation via symlink following (bsc#1275264).
• CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
• CVE-2026-77159: root chown() on swtpm logfile follows symlinks (bsc#1274946).

It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-18917)

It was discovered that libvirt did not correctly handle symbolic links when changing ownership of the TPM emulator log file. A local attacker with access to the swtpm account could possibly use this issue to cause libvirt to change the ownership of an arbitrary file. (CVE-2026-77159)

It was discovered that libvirt did not properly validate newline characters in DNS TXT record values and SRV record attributes in its virtual network driver. A local attacker with permission to define virtual networks could possibly use this issue to inject arbitrary dnsmasq configuration directives, leading to arbitrary command execution as root. (CVE-2026-61477)

It was discovered that libvirt did not properly handle errors during XML context parsing. An attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2026-61478)

He Wei discovered that libvirt had a symlink-following vulnerability in the file ownership change function used for virtual TPM state directories. A local attacker running as the swtpm user could possibly use this issue to cause libvirt to change the ownership of an arbitrary file, leading to privilege escalation. (CVE-2026-63622)

It was discovered that libvirt created storage volume images with overly permissive permissions during clone or convert operations. A local attacker could possibly use this issue to read guest disk contents, resulting in information disclosure. (CVE-2026-63623)

It was discovered that libvirt had an integer overflow in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue to cause libvirt to crash or execute arbitrary code. (CVE-2026-18917)

It was discovered that libvirt had a symlink-following flaw in the virtual TPM emulator setup function. A local attacker with access to the swtpm account could possibly use this issue to cause libvirt to change the ownership of an arbitrary file, leading to privilege escalation. (CVE-2026-77159)