An update for libvirt is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3633 Final 1.0 1.0 2026-09-05 Initial 2026-09-05 2026-09-05 openEuler SA Tool V1.0 2026-09-05 libvirt security update An update for libvirt is now available for openEuler-22.03-LTS-SP4 Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support. Security Fix(es): A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917) An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477) A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.(CVE-2026-63622) An update for libvirt is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High libvirt https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3633 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-18917 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-61477 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63622 https://nvd.nist.gov/vuln/detail/CVE-2026-18917 https://nvd.nist.gov/vuln/detail/CVE-2026-61477 https://nvd.nist.gov/vuln/detail/CVE-2026-63622 openEuler-22.03-LTS-SP4 libvirt-6.2.0-72.oe2203sp4.src.rpm libvirt-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-admin-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-bash-completion-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-client-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-config-network-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-config-nwfilter-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-interface-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-network-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-nodedev-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-nwfilter-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-qemu-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-secret-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-core-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-disk-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-gluster-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-iscsi-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-iscsi-direct-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-logical-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-mpath-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-rbd-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-driver-storage-scsi-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-kvm-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-daemon-qemu-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-debuginfo-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-debugsource-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-devel-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-docs-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-libs-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-lock-sanlock-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-nss-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-wireshark-6.2.0-72.oe2203sp4.x86_64.rpm libvirt-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-admin-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-bash-completion-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-client-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-config-network-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-config-nwfilter-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-interface-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-network-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-nodedev-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-nwfilter-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-qemu-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-secret-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-core-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-disk-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-gluster-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-iscsi-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-iscsi-direct-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-logical-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-mpath-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-rbd-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-driver-storage-scsi-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-kvm-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-daemon-qemu-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-debuginfo-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-debugsource-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-devel-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-docs-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-libs-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-lock-sanlock-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-nss-6.2.0-72.oe2203sp4.aarch64.rpm libvirt-wireshark-6.2.0-72.oe2203sp4.aarch64.rpm A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation. 2026-09-05 CVE-2026-18917 openEuler-22.03-LTS-SP4 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H libvirt security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3633 An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root. 2026-09-05 CVE-2026-61477 openEuler-22.03-LTS-SP4 Low 2.3 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N libvirt security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3633 A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control. 2026-09-05 CVE-2026-63622 openEuler-22.03-LTS-SP4 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H libvirt security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3633