Bug 2520161 (CVE-2026-18917)
| Summary: | CVE-2026-18917 libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2520165 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-08-20 09:04:51 UTC
Upstream issue & patch: - https://gitlab.com/libvirt/libvirt/-/work_items/903 - https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:68510 https://access.redhat.com/errata/RHSA-2026:68510 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:68509 https://access.redhat.com/errata/RHSA-2026:68509 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:68513 https://access.redhat.com/errata/RHSA-2026:68513 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:68514 https://access.redhat.com/errata/RHSA-2026:68514 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:68511 https://access.redhat.com/errata/RHSA-2026:68511 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:68594 https://access.redhat.com/errata/RHSA-2026:68594 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:69114 https://access.redhat.com/errata/RHSA-2026:69114 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:69131 https://access.redhat.com/errata/RHSA-2026:69131 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:74424 https://access.redhat.com/errata/RHSA-2026:74424 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:75583 https://access.redhat.com/errata/RHSA-2026:75583 |