OESA-2026-3635

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3635

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-3635.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-3635

Upstream

CVE-2026-18917

CVE-2026-61477

CVE-2026-63622

Published

2026-09-05T15:03:21Z

Modified

2026-09-05T15:16:27.377565929Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

libvirt security update

Details

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.(CVE-2026-63622)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:24.03-LTS-SP3 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/openEuler/libvirt&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.10.0-37.oe2403sp3

Ecosystem specific

{
    "x86_64": [
        "libvirt-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-client-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-common-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-config-network-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-config-nwfilter-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-interface-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-network-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-nodedev-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-nwfilter-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-qemu-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-secret-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-core-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-disk-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-gluster-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-iscsi-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-iscsi-direct-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-logical-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-mpath-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-rbd-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-driver-storage-scsi-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-kvm-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-lock-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-log-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-plugin-lockd-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-plugin-sanlock-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-proxy-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-daemon-qemu-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-debuginfo-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-debugsource-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-devel-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-docs-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-libs-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-nss-9.10.0-37.oe2403sp3.x86_64.rpm",
        "libvirt-wireshark-9.10.0-37.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "libvirt-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-client-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-common-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-config-network-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-config-nwfilter-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-interface-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-network-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-nodedev-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-nwfilter-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-qemu-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-secret-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-core-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-disk-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-gluster-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-iscsi-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-iscsi-direct-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-logical-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-mpath-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-rbd-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-driver-storage-scsi-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-kvm-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-lock-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-log-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-plugin-lockd-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-plugin-sanlock-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-proxy-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-daemon-qemu-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-debuginfo-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-debugsource-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-devel-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-docs-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-libs-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-nss-9.10.0-37.oe2403sp3.aarch64.rpm",
        "libvirt-wireshark-9.10.0-37.oe2403sp3.aarch64.rpm"
    ],
    "src": [
        "libvirt-9.10.0-37.oe2403sp3.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-3635.json"