Most recent entries from all

BELL-CVE-2026-63622

Affected: Alpaquita:23: libvirt, Alpaquita:25: libvirt, Alpaquita:stream: libvirt

EUVD-2026-382095

fkie_cve-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

GHSA-r329-fjhj-3cw3

OESA-2026-3632 — libvirt security update

Affected: openEuler:20.03-LTS-SP4: libvirt

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support. Security Fix(es):

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)

openSUSE-SU-2026:21738-1 — Security update for libvirt

Security update for libvirt

RHSA-2026:64773 — Red Hat Security Advisory: libvirt security update

libvirt: swtpm privilege escalation via symlink following

RLSA-2026:74424 — Important: libvirt security, bug fix, and enhancement update

Affected: Rocky Linux:9: libvirt

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

* libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

* libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917)

Bug Fix(es) and Enhancement(s):

* Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [rhel-9.8.z] (JIRA:Rocky Linux-186018)

* libvirt-guests does not work together with virtlockd on shutdown [rhel-9.8.z] (JIRA:Rocky Linux-224986)

* Expose guest-get-devices in libvirt-api [rhel-9.8.z] (JIRA:Rocky Linux-243306)

* allow hyperv pvpanic "device" to process Windows crash dump [rhel-9.8.z] (JIRA:Rocky Linux-242549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:23445-1 — Security update for libvirt

Security update for libvirt

UBUNTU-CVE-2026-63622

Affected: Ubuntu:Pro:20.04:LTS: libvirt, Ubuntu:22.04:LTS: libvirt, Ubuntu:24.04:LTS: libvirt, Ubuntu:26.04:LTS: libvirt, Ubuntu:26.04:LTS: libvirt-hwe

WID-SEC-W-2026-2724 — libvirt: Mehrere Schwachstellen ermöglichen

Ein lokaler Angreifer kann mehrere Schwachstellen in libvirt ausnutzen, um Administratorrechte zu erlangen und vertrauliche Informationen offenzulegen.