Bug 2520161 (CVE-2026-18917) - CVE-2026-18917 libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow
Summary: CVE-2026-18917 libvirt: Integer overflow in NodeGetFreePages RPC handler lead...
Keywords:
Status: NEW
Alias: CVE-2026-18917
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2520165
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-20 09:04 UTC by OSIDB Bzimport
Modified: 2026-09-17 11:10 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:68509 0 None None None 2026-09-17 06:10:28 UTC
Red Hat Product Errata RHSA-2026:68510 0 None None None 2026-09-17 06:08:14 UTC
Red Hat Product Errata RHSA-2026:68511 0 None None None 2026-09-17 06:26:05 UTC
Red Hat Product Errata RHSA-2026:68513 0 None None None 2026-09-17 06:11:50 UTC
Red Hat Product Errata RHSA-2026:68514 0 None None None 2026-09-17 06:14:43 UTC
Red Hat Product Errata RHSA-2026:68594 0 None None None 2026-09-17 11:10:11 UTC

Description OSIDB Bzimport 2026-08-20 09:04:51 UTC 
An integer overflow vulnerability was found in libvirt's NodeGetFreePages RPC handler in src/remote/remote_daemon_dispatch.c. The dispatcher computes a 32-bit product (pages_len * cellCount) for both validation and memory allocation. While pages_len is XDR-capped at 1024, cellCount remains unbounded. The multiplication truncates modulo 2^32, allowing crafted values to bypass the guard check. The undersized buffer is then overwritten with real NUMA node data. The RPC call requires only connect:read ACL (lowest permission tier) and is accessible via the world-readable Unix socket (mode 0666) with no authentication for VIR_CONNECT_RO clients. An unprivileged local user could exploit this to corrupt the root libvirt daemon's heap, leading to denial of service or potentially local privilege escalation.
Comment 1 Mauro Matteo Cascella 2026-08-20 09:10:21 UTC 
Upstream issue & patch:
- https://gitlab.com/libvirt/libvirt/-/work_items/903
- https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f
Comment 3 Jon Orris 2026-09-17 06:08:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:68510 https://access.redhat.com/errata/RHSA-2026:68510
Comment 4 Jon Orris 2026-09-17 06:10:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:68509 https://access.redhat.com/errata/RHSA-2026:68509
Comment 5 Jon Orris 2026-09-17 06:11:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:68513 https://access.redhat.com/errata/RHSA-2026:68513
Comment 6 Jon Orris 2026-09-17 06:14:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:68514 https://access.redhat.com/errata/RHSA-2026:68514
Comment 7 Jon Orris 2026-09-17 06:26:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:68511 https://access.redhat.com/errata/RHSA-2026:68511
Comment 8 Jon Orris 2026-09-17 11:10:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:68594 https://access.redhat.com/errata/RHSA-2026:68594
Note You need to log in before you can comment on or make changes to this bug.