{"id":"CVE-2026-77159","aliases":["AZL-101739","BELL-CVE-2026-77159","DEBIAN-CVE-2026-77159","EUVD-2026-76034","GHSA-wmhq-5pq5-8474","OESA-2026-4059","SUSE-SU-2026:23445-1","SUSE-SU-2026:23460-1","SUSE-SU-2026:23515-1","SUSE-SU-2026:23603-1","SUSE-SU-2026:3939-1","SUSE-SU-2026:4004-1","SUSE-SU-2026:4009-1","SUSE-SU-2026:4010-1","SUSE-SU-2026:4141-1","UBUNTU-CVE-2026-77159","USN-8831-1","USN-8833-1","openSUSE-SU-2026:11622-1","openSUSE-SU-2026:21738-1"],"status":"published","title":"Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink","description":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00162,"percentile":0.05448,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-61"],"published":"2026-08-27T00:00:00Z","modified":"2026-11-07T14:16:40Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libvirt","fixed_in":["11.9.0-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libvirt","fixed_in":["12.7.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvirt","fixed_in":["12.7.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libvirt","fixed_in":["6.2.0-30.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libvirt","fixed_in":["6.2.0-74.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libvirt","fixed_in":["9.10.0-45.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libvirt","fixed_in":["9.10.0-46.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libvirt","fixed_in":["9.10.0-45.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libvirt","fixed_in":["8.0.0-1ubuntu7.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libvirt","fixed_in":["10.0.0-2ubuntu8.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libvirt","fixed_in":["12.0.0-1ubuntu5.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libvirt-hwe","fixed_in":["12.0.0-1ubuntu5.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0-r2"},{"fixed":"12.7.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0-1","10.0.0-2","10.0.0-3","10.1.0-1","10.10.0-1","10.10.0-2","10.10.0-3","10.10.0-4","10.2.0-1","10.3.0-1","10.3.0-2","10.3.0-3","10.4.0-1","10.5.0-1","10.6.0-1","10.6.0-2","10.6.0-3","10.7.0-1","10.7.0-2","10.7.0-3","10.8.0-1","10.9.0-1","10.9.0-2","11.0.0-1","11.0.0-2","11.1.0-1","11.1.0-2","11.10.0-1","11.10.0-2","11.2.0-1","11.2.0-2","11.2.0-3","11.3.0-1","11.3.0-2","11.3.0-2~bpo12+1","11.3.0-3","11.4.0-1","11.5.0-1","11.6.0-1","11.7.0-1","11.8.0-1","11.8.0-2","11.9.0-1","11.9.0-2","12.0.0-1","12.1.0-1","12.2.0-1","12.3.0-1","12.4.0-1","12.5.0-1","12.6.0-1","12.7.0-1","12.8.0-1","9.0.0-4","9.0.0-4+deb12u1","9.0.0-4+deb12u2","9.1.0-1","9.10.0-1","9.2.0-1","9.2.0-2","9.3.0-1","9.3.0-2","9.4.0-1","9.5.0-1","9.5.0-2","9.6.0-1","9.6.0-2","9.6.0-3","9.7.0-1","9.8.0-1","9.8.0-2","9.9.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.10.0-1","11.10.0-2","11.3.0-3","11.3.0-3+deb13u1","11.3.0-3+deb13u2","11.3.0-3+deb13u3","11.4.0-1","11.5.0-1","11.6.0-1","11.7.0-1","11.8.0-1","11.8.0-2","11.9.0-1","11.9.0-2","12.0.0-1","12.1.0-1","12.2.0-1","12.3.0-1","12.4.0-1","12.5.0-1","12.6.0-1","12.7.0-1","12.8.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.7.0-1"}]}],"versions":["11.10.0-1","11.10.0-2","11.3.0-3","11.4.0-1","11.5.0-1","11.6.0-1","11.7.0-1","11.8.0-1","11.8.0-2","11.9.0-1","11.9.0-2","12.0.0-1","12.1.0-1","12.2.0-1","12.3.0-1","12.4.0-1","12.5.0-1","12.6.0-1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-30.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-74.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-45.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-46.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-45.oe2403sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-slfo.1.1_3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0-150700.4.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0-150700.4.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-150600.8.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-150600.8.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-13.48.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-13.48.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-0ubuntu8","1.1.1-0ubuntu9","1.1.4-0ubuntu2","1.1.4-0ubuntu3","1.1.4-0ubuntu4","1.1.4-0ubuntu5","1.2.0-0ubuntu1","1.2.0-0ubuntu2","1.2.0-0ubuntu3","1.2.1-0ubuntu1","1.2.1-0ubuntu2","1.2.1-0ubuntu3","1.2.1-0ubuntu4","1.2.1-0ubuntu5","1.2.1-0ubuntu7","1.2.1-0ubuntu8","1.2.1-0ubuntu9","1.2.1-0ubuntu10","1.2.2-0ubuntu1","1.2.2-0ubuntu2","1.2.2-0ubuntu3","1.2.2-0ubuntu4","1.2.2-0ubuntu5","1.2.2-0ubuntu6","1.2.2-0ubuntu7","1.2.2-0ubuntu8","1.2.2-0ubuntu9","1.2.2-0ubuntu10","1.2.2-0ubuntu11","1.2.2-0ubuntu12","1.2.2-0ubuntu13","1.2.2-0ubuntu13.1","1.2.2-0ubuntu13.1.1","1.2.2-0ubuntu13.1.2","1.2.2-0ubuntu13.1.4","1.2.2-0ubuntu13.1.5","1.2.2-0ubuntu13.1.6","1.2.2-0ubuntu13.1.7","1.2.2-0ubuntu13.1.8","1.2.2-0ubuntu13.1.9","1.2.2-0ubuntu13.1.10","1.2.2-0ubuntu13.1.12","1.2.2-0ubuntu13.1.14","1.2.2-0ubuntu13.1.16","1.2.2-0ubuntu13.1.17","1.2.2-0ubuntu13.1.20","1.2.2-0ubuntu13.1.21","1.2.2-0ubuntu13.1.22","1.2.2-0ubuntu13.1.23","1.2.2-0ubuntu13.1.25","1.2.2-0ubuntu13.1.26","1.2.2-0ubuntu13.1.27","1.2.2-0ubuntu13.1.28","1.2.2-0ubuntu13.1.28+esm1","1.2.2-0ubuntu13.1.28+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.16-2ubuntu11","1.2.16-2ubuntu12","1.2.16-2ubuntu13","1.2.16-2ubuntu14","1.2.21-2ubuntu1","1.2.21-2ubuntu3","1.2.21-2ubuntu4","1.2.21-2ubuntu5","1.2.21-2ubuntu7","1.2.21-2ubuntu8","1.2.21-2ubuntu9","1.2.21-2ubuntu10","1.3.1-1ubuntu1","1.3.1-1ubuntu2","1.3.1-1ubuntu3","1.3.1-1ubuntu4","1.3.1-1ubuntu6","1.3.1-1ubuntu9","1.3.1-1ubuntu10","1.3.1-1ubuntu10.1","1.3.1-1ubuntu10.2","1.3.1-1ubuntu10.3","1.3.1-1ubuntu10.5","1.3.1-1ubuntu10.6","1.3.1-1ubuntu10.7","1.3.1-1ubuntu10.8","1.3.1-1ubuntu10.10","1.3.1-1ubuntu10.11","1.3.1-1ubuntu10.12","1.3.1-1ubuntu10.13","1.3.1-1ubuntu10.14","1.3.1-1ubuntu10.15","1.3.1-1ubuntu10.17","1.3.1-1ubuntu10.18","1.3.1-1ubuntu10.19","1.3.1-1ubuntu10.21","1.3.1-1ubuntu10.22","1.3.1-1ubuntu10.23","1.3.1-1ubuntu10.24","1.3.1-1ubuntu10.25","1.3.1-1ubuntu10.26","1.3.1-1ubuntu10.27","1.3.1-1ubuntu10.29","1.3.1-1ubuntu10.30","1.3.1-1ubuntu10.31","1.3.1-1ubuntu10.31+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.0-1ubuntu5","3.6.0-1ubuntu6","4.0.0-1ubuntu1","4.0.0-1ubuntu2","4.0.0-1ubuntu3","4.0.0-1ubuntu4","4.0.0-1ubuntu5","4.0.0-1ubuntu6","4.0.0-1ubuntu7","4.0.0-1ubuntu8","4.0.0-1ubuntu8.1","4.0.0-1ubuntu8.2","4.0.0-1ubuntu8.3","4.0.0-1ubuntu8.4","4.0.0-1ubuntu8.5","4.0.0-1ubuntu8.6","4.0.0-1ubuntu8.7","4.0.0-1ubuntu8.8","4.0.0-1ubuntu8.9","4.0.0-1ubuntu8.10","4.0.0-1ubuntu8.11","4.0.0-1ubuntu8.12","4.0.0-1ubuntu8.13","4.0.0-1ubuntu8.14","4.0.0-1ubuntu8.15","4.0.0-1ubuntu8.16","4.0.0-1ubuntu8.17","4.0.0-1ubuntu8.19","4.0.0-1ubuntu8.20","4.0.0-1ubuntu8.21","4.0.0-1ubuntu8.21+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-0ubuntu5","6.0.0-0ubuntu1","6.0.0-0ubuntu2","6.0.0-0ubuntu3","6.0.0-0ubuntu4","6.0.0-0ubuntu5","6.0.0-0ubuntu6","6.0.0-0ubuntu7","6.0.0-0ubuntu8","6.0.0-0ubuntu8.1","6.0.0-0ubuntu8.2","6.0.0-0ubuntu8.3","6.0.0-0ubuntu8.4","6.0.0-0ubuntu8.5","6.0.0-0ubuntu8.7","6.0.0-0ubuntu8.8","6.0.0-0ubuntu8.9","6.0.0-0ubuntu8.10","6.0.0-0ubuntu8.11","6.0.0-0ubuntu8.12","6.0.0-0ubuntu8.13","6.0.0-0ubuntu8.14","6.0.0-0ubuntu8.15","6.0.0-0ubuntu8.16","6.0.0-0ubuntu8.19","6.0.0-0ubuntu8.20","6.0.0-0ubuntu8.20+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-1ubuntu7.21"}]}],"versions":["7.6.0-0ubuntu1","7.6.0-0ubuntu3","8.0.0-1ubuntu3","8.0.0-1ubuntu4","8.0.0-1ubuntu5","8.0.0-1ubuntu6","8.0.0-1ubuntu7","8.0.0-1ubuntu7.1","8.0.0-1ubuntu7.2","8.0.0-1ubuntu7.3","8.0.0-1ubuntu7.4","8.0.0-1ubuntu7.5","8.0.0-1ubuntu7.6","8.0.0-1ubuntu7.7","8.0.0-1ubuntu7.8","8.0.0-1ubuntu7.9","8.0.0-1ubuntu7.10","8.0.0-1ubuntu7.11","8.0.0-1ubuntu7.12","8.0.0-1ubuntu7.13","8.0.0-1ubuntu7.14","8.0.0-1ubuntu7.15","8.0.0-1ubuntu7.16","8.0.0-1ubuntu7.17","8.0.0-1ubuntu7.18","8.0.0-1ubuntu7.19","8.0.0-1ubuntu7.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-2ubuntu8.19"}]}],"versions":["9.6.0-1ubuntu1","9.6.0-1ubuntu2","10.0.0-1ubuntu1","10.0.0-2ubuntu1","10.0.0-2ubuntu5","10.0.0-2ubuntu7","10.0.0-2ubuntu8","10.0.0-2ubuntu8.1","10.0.0-2ubuntu8.2","10.0.0-2ubuntu8.3","10.0.0-2ubuntu8.4","10.0.0-2ubuntu8.5","10.0.0-2ubuntu8.6","10.0.0-2ubuntu8.7","10.0.0-2ubuntu8.8","10.0.0-2ubuntu8.9","10.0.0-2ubuntu8.10","10.0.0-2ubuntu8.11","10.0.0-2ubuntu8.12","10.0.0-2ubuntu8.13","10.0.0-2ubuntu8.14","10.0.0-2ubuntu8.15","10.0.0-2ubuntu8.16","10.0.0-2ubuntu8.17"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.5"}]}],"versions":["11.6.0-1ubuntu3","11.6.0-1ubuntu5","11.6.0-1ubuntu6","11.6.0-1ubuntu7","11.6.0-1ubuntu8","12.0.0-1ubuntu3","12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2","12.0.0-1ubuntu5.3","12.0.0-1ubuntu5.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.5"}]}],"versions":["12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2","12.0.0-1ubuntu5.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-1ubuntu7.21"}]}],"versions":["7.6.0-0ubuntu1","7.6.0-0ubuntu3","8.0.0-1ubuntu3","8.0.0-1ubuntu4","8.0.0-1ubuntu5","8.0.0-1ubuntu6","8.0.0-1ubuntu7","8.0.0-1ubuntu7.1","8.0.0-1ubuntu7.2","8.0.0-1ubuntu7.3","8.0.0-1ubuntu7.4","8.0.0-1ubuntu7.5","8.0.0-1ubuntu7.6","8.0.0-1ubuntu7.7","8.0.0-1ubuntu7.8","8.0.0-1ubuntu7.9","8.0.0-1ubuntu7.10","8.0.0-1ubuntu7.11","8.0.0-1ubuntu7.12","8.0.0-1ubuntu7.13","8.0.0-1ubuntu7.14","8.0.0-1ubuntu7.15","8.0.0-1ubuntu7.16","8.0.0-1ubuntu7.17","8.0.0-1ubuntu7.18","8.0.0-1ubuntu7.19","8.0.0-1ubuntu7.20"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-2ubuntu8.19"}]}],"versions":["9.6.0-1ubuntu1","9.6.0-1ubuntu2","10.0.0-1ubuntu1","10.0.0-2ubuntu1","10.0.0-2ubuntu5","10.0.0-2ubuntu7","10.0.0-2ubuntu8","10.0.0-2ubuntu8.1","10.0.0-2ubuntu8.2","10.0.0-2ubuntu8.3","10.0.0-2ubuntu8.4","10.0.0-2ubuntu8.5","10.0.0-2ubuntu8.6","10.0.0-2ubuntu8.7","10.0.0-2ubuntu8.8","10.0.0-2ubuntu8.9","10.0.0-2ubuntu8.10","10.0.0-2ubuntu8.11","10.0.0-2ubuntu8.12","10.0.0-2ubuntu8.13","10.0.0-2ubuntu8.14","10.0.0-2ubuntu8.15","10.0.0-2ubuntu8.16","10.0.0-2ubuntu8.17"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.5"}]}],"versions":["11.6.0-1ubuntu3","11.6.0-1ubuntu5","11.6.0-1ubuntu6","11.6.0-1ubuntu7","11.6.0-1ubuntu8","12.0.0-1ubuntu3","12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2","12.0.0-1ubuntu5.3","12.0.0-1ubuntu5.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.5"}]}],"versions":["12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2","12.0.0-1ubuntu5.3"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.6.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.5.1"}]}],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-77159","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531811","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.com/libvirt/libvirt/-/work_items/909","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77159","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wmhq-5pq5-8474"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-77159","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-77159","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4059","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623445-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258345","tags":["report"]},{"url":"https://bugzilla.suse.com/1274576","tags":["report"]},{"url":"https://bugzilla.suse.com/1274946","tags":["report"]},{"url":"https://bugzilla.suse.com/1275264","tags":["report"]},{"url":"https://bugzilla.suse.com/1275265","tags":["report"]},{"url":"https://bugzilla.suse.com/1275863","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77159","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623460-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623515-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623603-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263939-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266364","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264004-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264009-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264010-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264141-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-77159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77159","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8831-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8833-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-18917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-61477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-61478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63623","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-77159","title":"Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink","description":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.","status":"published","published":"2026-09-11T10:32:29.772Z","modified":"2026-11-06T00:45:17.55Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-61"],"updated_at":"2026-11-06T01:55:46.939755Z"}],"euvd":[{"id":"EUVD-2026-76034","description":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.","status":"published","published":"2026-09-11T10:32:29Z","modified":"2026-11-06T00:45:17Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-wmhq-5pq5-8474","title":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The...","description":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.","status":"published","published":"2026-09-11T12:33:25Z","modified":"2026-09-11T12:33:33Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T15:11:44.427999Z"}],"nvd":[{"id":"CVE-2026-77159","description":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.","status":"published","published":"2026-09-11T11:16:54.677Z","modified":"2026-11-06T01:17:51.823Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-61"],"updated_at":"2026-11-06T06:59:05.303911Z"}],"osv":[{"id":"BELL-CVE-2026-77159","status":"published","published":"2026-09-13T06:04:28.8472Z","modified":"2026-10-06T07:15:02.642792274Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"DEBIAN-CVE-2026-77159","description":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.","status":"published","published":"2026-09-11T11:16:54.677Z","modified":"2026-11-06T10:04:07.187483475Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"OESA-2026-4059","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA symlink-following flaw was found in libvirt\u0026apos;s qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.(CVE-2026-77159)","status":"published","published":"2026-09-25T01:27:51Z","modified":"2026-09-25T01:45:11.312475147Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-77159","description":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.","status":"published","published":"2026-09-11T11:16:00Z","modified":"2026-09-28T17:30:07.262292356Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"AZL-101739","title":"CVE-2026-77159 affecting package libvirt for versions less than 11.9.0-2","description":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.","status":"published","published":"2026-09-11T11:16:54Z","modified":"2026-11-07T14:16:40.971376095Z","updated_at":"2026-11-07T14:48:25.680996Z"},{"id":"openSUSE-SU-2026:11622-1","title":"libvirt-12.6.0-2.1 on GA media","description":"These are all security issues fixed in the libvirt-12.6.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-27T00:00:00Z","modified":"2026-08-28T18:23:09.410065624Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21738-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: integer overflow in `NodeGetFreePages` RPC handler leads to heap buffer overflow and allows for\n  possible local privilege escalation (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for `dnsmasq` configuration directive\n  injection and can lead to arbitrary code execution as root (bsc#1274576).\n- CVE-2026-63622: symlink-following in `virFileChownFiles()` allows `swtpm` user to trick the root-level `libvirt`\n  daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).\n- CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can\n  lead to sensitive information disclosure (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks and allows for root-owned file ownership changes,\n  which can lead to privilege escalation (bsc#1274946).\n","status":"published","published":"2026-09-02T09:43:39Z","modified":"2026-09-09T18:23:13.514876254Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23445-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n\nChanges for libvirt:\n\n- rpc: avoid leak of GSource in use for interrupting main loop\n bsc#1258345\n","status":"published","published":"2026-09-02T09:40:30Z","modified":"2026-09-14T18:23:11.20611883Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23460-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: integer overflow in `NodeGetFreePages` RPC handler leads to heap buffer overflow and allows for\n  possible local privilege escalation (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for `dnsmasq` configuration directive\n  injection and can lead to arbitrary code execution as root (bsc#1274576).\n- CVE-2026-63622: symlink-following in `virFileChownFiles()` allows `swtpm` user to trick the root-level `libvirt`\n  daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).\n- CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can\n  lead to sensitive information disclosure (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks and allows for root-owned file ownership changes,\n  which can lead to privilege escalation (bsc#1274946).\n","status":"published","published":"2026-09-02T09:40:54Z","modified":"2026-09-14T18:23:16.683596226Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23515-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-02T09:15:59Z","modified":"2026-09-15T18:23:08.893661968Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23603-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: integer overflow in `NodeGetFreePages` RPC handler leads to heap buffer overflow and allows for\n  possible local privilege escalation (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for `dnsmasq` configuration directive\n  injection and can lead to arbitrary code execution as root (bsc#1274576).\n- CVE-2026-63622: symlink-following in `virFileChownFiles()` allows `swtpm` user to trick the root-level `libvirt`\n  daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).\n- CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can\n  lead to sensitive information disclosure (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks and allows for root-owned file ownership changes,\n  which can lead to privilege escalation (bsc#1274946).\n","status":"published","published":"2026-09-02T09:40:54Z","modified":"2026-09-29T18:23:19.004436484Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3939-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: remote: Fix integer overflow in RPC handler for virNodeGetFreePages (bsc#1275863)\n- CVE-2026-63622: util: virFileChownFiles: do not follow symlinks (bsc#1275264)\n- CVE-2026-63623: storage: create images with a private umask during qemu-img create/convert (bsc#12075265)\n- CVE-2026-77159: qemu: tpm: Avoid following symlinks when chown'ing log file (bsc#1274946)\n- CVE-2026-61477: Reject line breaks in network config (bsc#1274576)\n- qemu: Fix invocation of numa-preplace when hugepages requested, but page size not specified (bsc#1266364)\n- Add ClearwaterForest CPU model (jsc#PED-16192)\n","status":"published","published":"2026-09-03T07:32:04Z","modified":"2026-09-10T18:23:18.060995579Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4004-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-07T07:30:37Z","modified":"2026-09-13T18:23:14.56483128Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4009-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-07T07:33:47Z","modified":"2026-09-13T18:23:15.157335781Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4010-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-07T07:34:04Z","modified":"2026-09-13T18:23:15.168339372Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4141-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-14T07:58:58Z","modified":"2026-09-28T18:23:12.648589568Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8831-1","title":"libvirt vulnerabilities","description":"It was discovered that libvirt had an integer overflow vulnerability in\nthe NodeGetFreePages RPC handler. A local attacker could possibly use\nthis issue to cause a denial of service or execute arbitrary code.\n(CVE-2026-18917)\n\nIt was discovered that libvirt did not correctly handle symbolic links\nwhen changing ownership of the TPM emulator log file. A local attacker\nwith access to the swtpm account could possibly use this issue to cause libvirt\nto change the ownership of an arbitrary file. (CVE-2026-77159)","status":"published","published":"2026-09-28T11:48:10Z","modified":"2026-09-28T17:42:46.453246528Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8833-1","title":"libvirt-hwe vulnerabilities","description":"It was discovered that libvirt did not properly validate newline characters\nin DNS TXT record values and SRV record attributes in its virtual network\ndriver. A local attacker with permission to define virtual networks could\npossibly use this issue to inject arbitrary dnsmasq configuration\ndirectives, leading to arbitrary command execution as root.\n(CVE-2026-61477)\n\nIt was discovered that libvirt did not properly handle errors during XML\ncontext parsing. An attacker could possibly use this issue to cause libvirt\nto crash, resulting in a denial of service. (CVE-2026-61478)\n\nHe Wei discovered that libvirt had a symlink-following vulnerability in the\nfile ownership change function used for virtual TPM state directories. A\nlocal attacker running as the swtpm user could possibly use this issue to\ncause libvirt to change the ownership of an arbitrary file, leading to\nprivilege escalation. (CVE-2026-63622)\n\nIt was discovered that libvirt created storage volume images with overly\npermissive permissions during clone or convert operations. A local attacker\ncould possibly use this issue to read guest disk contents, resulting in\ninformation disclosure. (CVE-2026-63623)\n\nIt was discovered that libvirt had an integer overflow in the\nNodeGetFreePages RPC handler. A local attacker could possibly use this\nissue to cause libvirt to crash or execute arbitrary code.\n(CVE-2026-18917)\n\nIt was discovered that libvirt had a symlink-following flaw in the virtual\nTPM emulator setup function. A local attacker with access to the swtpm\naccount could possibly use this issue to cause libvirt to change the\nownership of an arbitrary file, leading to privilege escalation.\n(CVE-2026-77159)","status":"published","published":"2026-09-28T11:57:56Z","modified":"2026-09-28T17:42:51.297248796Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}