Executive brief
libvirt is a virtualization management library used across Linux systems to manage virtual machines and containers. An unprivileged local user can exploit an integer overflow flaw in the NodeGetFreePages RPC handler to corrupt memory in the root libvirt daemon, resulting in denial of service or privilege escalation to root.
Technical details
The vulnerability is an integer overflow in libvirt's NodeGetFreePages RPC handler that allows crafted values to bypass a size check, resulting in undersized memory buffer allocation. This leads to a heap buffer overflow when real NUMA node data overwrites the undersized buffer. An unprivileged local attacker with network access to the libvirt RPC interface can trigger this condition without authentication. Successful exploitation corrupts the root libvirt daemon's memory, enabling denial of service or local privilege escalation. Patches are available via Red Hat Enterprise Linux 9.4 updates (libvirt-10.0.0-6.24.el9_4 and later).
Affected products
- libvirt libvirt before 10.0.0-6.24.el9_4
Timeline
- 2026-08-20: disclosed
- 2026-09-17: advisory: Red Hat security advisory RHSA-2026:68509 issued