Bug 2496401

Summary:	CVE-2026-13574 python-llvmlite: LLVM: Denial of service via heap-based buffer overflow in Bitcode File Handler [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Ganesh <gnaik>
Component:	python-llvmlite	Assignee:	Ben Beasley <code>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	code, neuro-sig, sanjay.ankur
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["cc104964-3d04-487f-8b2b-a3101b68b737"]}
Fixed In Version:	python-llvmlite-0.48.0-1.fc45	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-07-05 05:12:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2453491
Bug Blocks:	2494420

Description Ganesh 2026-07-02 07:50:10 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Comment 1 Ben Beasley 2026-07-02 10:30:17 UTC

I’m not sure that it makes sense to file bugs against packages just because they use llvm compat packages. (At least, I guess that was the rationale). Packages that do so generally do it for a reason, and can’t just upgrade willy-nilly. Besides, the bug is in LLVM, not in the packages that link it.

It happens that llvmlite upstream just released version 0.48.0 with support for llvm 22, just a few hours ago, so this can be “fixed,” at least in Rawhide. (Scare quotes because it seems awfully difficult to exploit. It would at minimum require JIT’ing untrusted code that was extraordinarily well-crafted, and then it’s merely a denial of service?)

Comment 2 Fedora Update System 2026-07-05 05:10:14 UTC

FEDORA-2026-ebbaee3606 (python-llvmlite-0.48.0-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-ebbaee3606

Comment 3 Fedora Update System 2026-07-05 05:12:44 UTC

FEDORA-2026-ebbaee3606 (python-llvmlite-0.48.0-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.