Bug 2520165

Summary: CVE-2026-18917 libvirt: Local privilege escalation or denial of service via integer overflow [fedora-all]
Product: [Fedora] Fedora Reporter: Mauro Matteo Cascella <mcascell>
Component: libvirtAssignee: Fedora Virtualization Maintainers <virt-maint>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: berrange, clalancette, crobinso, jforbes, jiyin, laine, libvirt-maint, suraj.ghimire7, virt-maint
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["085a8df3-fe73-4e51-92c6-ad4ee07bcfe8"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2520161    

Description Mauro Matteo Cascella 2026-08-20 09:17:03 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

An integer overflow vulnerability was found in libvirt's NodeGetFreePages RPC handler in src/remote/remote_daemon_dispatch.c. The dispatcher computes a 32-bit product (pages_len * cellCount) for both validation and memory allocation. While pages_len is XDR-capped at 1024, cellCount remains unbounded. The multiplication truncates modulo 2^32, allowing crafted values to bypass the guard check. The undersized buffer is then overwritten with real NUMA node data. The RPC call requires only connect:read ACL (lowest permission tier) and is accessible via the world-readable Unix socket (mode 0666) with no authentication for VIR_CONNECT_RO clients. An unprivileged local user could exploit this to corrupt the root libvirt daemon's heap, leading to denial of service or potentially local privilege escalation.