A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Sep 21, 2026 | Aug 20, 2026 |
| Redhat_linux | — | Upgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-clientUpgrade libvirt-daemon-plugin-sanlockUpgrade libvirt-daemonUpgrade libvirt-bash-completionNo solution existsUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-secret-debuginfoUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-config-networkUpgrade libvirt-login-shellUpgrade libvirt-daemon-proxy-debuginfoUpgrade libvirt-daemon-driver-interface-debuginfoUpgrade libvirt-wireshark-debuginfoUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-iscsi-debuginfoUpgrade libvirt-lock-sanlockUpgrade libvirt-develUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-secretUpgrade libvirtUpgrade libvirt-daemon-driver-storage-scsi-debuginfoUpgrade libvirt-daemon-common-debuginfoUpgrade libvirt-debugsourceUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-client-debuginfoUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-lock-sanlock-debuginfoUpgrade libvirt-daemon-driver-nwfilter-debuginfoUpgrade libvirt-libs-debuginfoUpgrade libvirt-daemon-driver-qemu-debuginfoUpgrade libvirt-daemon-logUpgrade libvirt-daemon-plugin-lockd-debuginfoUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-lock-debuginfoUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-core-debuginfoUpgrade libvirt-daemon-debuginfoUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-network-debuginfoUpgrade libvirt-daemon-driver-nodedev-debuginfoUpgrade libvirt-ssh-proxyUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-nssUpgrade libvirt-nss-debuginfoUpgrade libvirt-daemon-proxyUpgrade libvirt-ssh-proxy-debuginfoUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-plugin-lockdUpgrade libvirt-daemon-log-debuginfoUpgrade libvirt-client-qemuUpgrade libvirt-debuginfoUpgrade libvirt-daemon-lockUpgrade libvirt-daemon-driver-storage-disk-debuginfoUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-logical-debuginfoUpgrade libvirt-daemon-commonUpgrade libvirt-daemon-driver-storage-rbd-debuginfoUpgrade libvirt-libsUpgrade libvirt-daemon-plugin-sanlock-debuginfoUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-mpath-debuginfo | Aug 24, 2026 | Aug 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub