Executive brief
A vulnerability was found in libvirt, a tool used to manage virtualization platforms like KVM. An attacker with limited access to the system can provide a specially crafted configuration file that forces the software to consume all available memory. This can cause the virtualization service to crash, potentially disrupting all virtual machines running on the host.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in libvirt's XML processing logic. The root cause is that libvirt parses user-provided XML files before performing Access Control List (ACL) checks. A local attacker with low privileges can submit a maliciously crafted XML file that triggers excessive memory allocation during the parsing phase. This leads to a denial-of-service (DoS) condition by crashing the libvirt daemon on the host. The issue has been addressed in Red Hat Enterprise Linux via security updates RHSA-2026:18748 and RHSA-2026:18326.
Affected products
- libvirt libvirt Fixed in 11.10.0-12.el9_8 and later versions
- Red Hat Enterprise Linux 9 All versions prior to RHSA-2026:18748
- Red Hat Enterprise Linux 10 All versions prior to RHSA-2026:18326
Timeline
- 2025-11-10: disclosed: Bug reported to Red Hat Bugzilla
- 2025-11-11: advisory: CVE published by NVD/Red Hat
- 2026-05-19: patched: Red Hat released security updates for RHEL 9 and 10