An update for libvirt is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3832 Final 1.0 1.0 2026-09-14 Initial 2026-09-14 2026-09-14 openEuler SA Tool V1.0 2026-09-14 libvirt security update An update for libvirt is now available for openEuler-24.03-LTS-SP4 Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support. Security Fix(es): A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917) An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477) A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.(CVE-2026-63622) A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.(CVE-2026-63623) An update for libvirt is now available for openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High libvirt https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3832 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-18917 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-61477 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63622 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63623 https://nvd.nist.gov/vuln/detail/CVE-2026-18917 https://nvd.nist.gov/vuln/detail/CVE-2026-61477 https://nvd.nist.gov/vuln/detail/CVE-2026-63622 https://nvd.nist.gov/vuln/detail/CVE-2026-63623 openEuler-24.03-LTS-SP4 libvirt-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-client-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-common-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-config-network-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-config-nwfilter-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-interface-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-network-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-nodedev-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-nwfilter-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-qemu-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-secret-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-core-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-disk-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-gluster-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-iscsi-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-iscsi-direct-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-logical-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-mpath-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-rbd-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-driver-storage-scsi-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-kvm-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-lock-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-log-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-plugin-lockd-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-plugin-sanlock-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-proxy-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-daemon-qemu-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-debuginfo-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-debugsource-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-devel-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-docs-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-libs-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-nss-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-wireshark-9.10.0-37.oe2403sp4.aarch64.rpm libvirt-9.10.0-37.oe2403sp4.src.rpm libvirt-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-client-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-common-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-config-network-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-config-nwfilter-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-interface-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-network-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-nodedev-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-nwfilter-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-qemu-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-secret-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-core-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-disk-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-gluster-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-iscsi-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-iscsi-direct-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-logical-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-mpath-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-rbd-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-driver-storage-scsi-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-kvm-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-lock-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-log-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-plugin-lockd-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-plugin-sanlock-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-proxy-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-daemon-qemu-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-debuginfo-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-debugsource-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-devel-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-docs-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-libs-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-nss-9.10.0-37.oe2403sp4.x86_64.rpm libvirt-wireshark-9.10.0-37.oe2403sp4.x86_64.rpm A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation. 2026-09-14 CVE-2026-18917 openEuler-24.03-LTS-SP4 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H libvirt security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3832 An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root. 2026-09-14 CVE-2026-61477 openEuler-24.03-LTS-SP4 Low 2.3 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N libvirt security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3832 A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control. 2026-09-14 CVE-2026-63622 openEuler-24.03-LTS-SP4 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H libvirt security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3832 A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines. 2026-09-14 CVE-2026-63623 openEuler-24.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N libvirt security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3832