Most recent entries from all

CVE-2026-77159 — Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

2026-09-29T07:05:53.718098+00:00

Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

USN-8831-1 — libvirt vulnerabilities

2026-09-29T07:05:53.718221+00:00

Affected: Ubuntu:22.04:LTS: libvirt, Ubuntu:24.04:LTS: libvirt, Ubuntu:26.04:LTS: libvirt

It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-18917)

It was discovered that libvirt did not correctly handle symbolic links when changing ownership of the TPM emulator log file. A local attacker with access to the swtpm account could possibly use this issue to cause libvirt to change the ownership of an arbitrary file. (CVE-2026-77159)