Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. An integer overflow vulnerability was found in libvirt's NodeGetFreePages RPC handler in src/remote/remote_daemon_dispatch.c. The dispatcher computes a 32-bit product (pages_len * cellCount) for both validation and memory allocation. While pages_len is XDR-capped at 1024, cellCount remains unbounded. The multiplication truncates modulo 2^32, allowing crafted values to bypass the guard check. The undersized buffer is then overwritten with real NUMA node data. The RPC call requires only connect:read ACL (lowest permission tier) and is accessible via the world-readable Unix socket (mode 0666) with no authentication for VIR_CONNECT_RO clients. An unprivileged local user could exploit this to corrupt the root libvirt daemon's heap, leading to denial of service or potentially local privilege escalation.
Created attachment 2161887 [details] upstream patch
Hello, Thank you for maintaining libvirt in Fedora. I've attached a backport of the upstream fix for CVE-2026-18917 for Fedora 43 and 44, and would appreciate your review. Fedora 45 needs the same fix. CVE-2026-18917 is an integer overflow in the RPC handler for virNodeGetFreePages() (remoteDispatchNodeGetFreePages). The handler multiplies the client-supplied page count and cell count as unsigned int, then uses the product both for the REMOTE_NODE_MAX_CELLS limit check and for the result buffer allocation. Values chosen so that the product wraps (for example 1023 x 4198405, which wraps to 1019) pass the check and get an undersized buffer, and the hypervisor driver then writes past the end of it. Upstream notes this can be triggered through a read-only connection. At minimum it crashes the daemon. Fedora 43 (11.6.0), Fedora 44 (12.0.0) and Fedora 45 (12.6.0) are affected. Rawhide (12.8.0) already has the fix, which first shipped upstream in 12.7.0. The attachment is upstream commit 5a62cbf2907d4590283597b46da9c0f41e7b4d4f, unmodified: https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f It adds the existing VIR_INT_MULTIPLY_OVERFLOW() check before the limit comparison and updates the error message. Nothing else in the function changes. Testing: the patch applies cleanly to the current Fedora 43 and 44 sources (the affected file is identical in both). It also applies to upstream 12.6.0, but I have not checked it against Fedora 45's own patches. I checked the arithmetic with a small model of the old and new conditions: the old check accepts the wrapped value and the new one rejects it. I did not run the daemon or a hypervisor driver against it, and I have not done a Mock or full RPM build. AI assistance was used to prepare this patch and its validation. The resulting changes and validation results were reviewed by a human. Thank you for taking a look.
FEDORA-2026-d5660d0b55 (libvirt-12.6.0-4.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5660d0b55
FEDORA-2026-e9531fdef1 (libvirt-12.0.0-6.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-e9531fdef1
FEDORA-2026-e9531fdef1 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-e9531fdef1` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-e9531fdef1 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-d5660d0b55 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d5660d0b55` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5660d0b55 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-46b48b717f (libvirt-11.6.0-4.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-46b48b717f
FEDORA-2026-46b48b717f has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-46b48b717f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-46b48b717f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.