{"id":"OESA-2026-3635","summary":"libvirt security update","details":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)\n\nAn injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)\n\nA flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.(CVE-2026-63622)","modified":"2026-09-05T15:16:27.377565929Z","published":"2026-09-05T15:03:21Z","upstream":["CVE-2026-18917","CVE-2026-61477","CVE-2026-63622"],"database_specific":{"severity":"High"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3635"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18917"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61477"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63622"}],"affected":[{"package":{"name":"libvirt","ecosystem":"openEuler:24.03-LTS-SP3","purl":"pkg:rpm/openEuler/libvirt&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-37.oe2403sp3"}]}],"ecosystem_specific":{"aarch64":["libvirt-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-client-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-common-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-config-network-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-config-nwfilter-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-interface-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-network-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-nodedev-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-nwfilter-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-qemu-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-secret-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-core-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-disk-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-gluster-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-iscsi-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-iscsi-direct-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-logical-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-mpath-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-rbd-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-driver-storage-scsi-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-kvm-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-lock-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-log-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-plugin-lockd-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-plugin-sanlock-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-proxy-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-daemon-qemu-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-debuginfo-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-debugsource-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-devel-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-docs-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-libs-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-nss-9.10.0-37.oe2403sp3.aarch64.rpm","libvirt-wireshark-9.10.0-37.oe2403sp3.aarch64.rpm"],"src":["libvirt-9.10.0-37.oe2403sp3.src.rpm"],"x86_64":["libvirt-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-client-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-common-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-config-network-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-config-nwfilter-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-interface-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-network-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-nodedev-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-nwfilter-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-qemu-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-secret-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-core-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-disk-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-gluster-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-iscsi-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-iscsi-direct-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-logical-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-mpath-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-rbd-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-driver-storage-scsi-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-kvm-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-lock-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-log-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-plugin-lockd-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-plugin-sanlock-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-proxy-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-daemon-qemu-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-debuginfo-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-debugsource-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-devel-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-docs-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-libs-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-nss-9.10.0-37.oe2403sp3.x86_64.rpm","libvirt-wireshark-9.10.0-37.oe2403sp3.x86_64.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-3635.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}