Skip to content
Fencer Vulns
high 7.8

CVE-2026-18917 json

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

published 2026-08-20 2 mo ago modified 2026-11-04 4 d ago also EUVD-2026-63239

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:11.10.0-12.9.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:10.10.0-8.12.el10_0
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:4.5.0-36.el7_9.7
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260916092751.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260916092751.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260910092451.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020260910092451.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260910092120.63b34585
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260910092120.63b34585
  • Red Hat Red Hat Enterprise Linux 9 0:11.10.0-12.7.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:9.0.0-10.17.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:10.0.0-6.24.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:10.10.0-7.19.el9_6
  • libvirt Debian 13 11.3.0-3+deb13u3
  • libvirt Debian 14 12.7.0-1

debian advisories DEBIAN-CVE-2026-18917

  • libvirt Ubuntu 22.04 LTS 8.0.0-1ubuntu7.21
  • libvirt Ubuntu 24.04 LTS 10.0.0-2ubuntu8.19
  • libvirt Ubuntu 26.04 LTS 12.0.0-1ubuntu5.5
  • libvirt-hwe Ubuntu 26.04 LTS 12.0.0-1ubuntu5.5

ubuntu advisories UBUNTU-CVE-2026-18917

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libvirt RHEL 10.2 11.10.0-12.9.el10_2
  • libvirt-nss RHEL 10.2 11.10.0-12.9.el10_2
  • libvirt-libs RHEL 10.2 11.10.0-12.9.el10_2
  • libvirt-client RHEL 10.2 11.10.0-12.9.el10_2
  • libvirt-daemon RHEL 10.2 11.10.0-12.9.el10_2
  • libvirt-ssh-proxy RHEL 10.2 11.10.0-12.9.el10_2
  • libvirt-daemon-kvm RHEL 10.2 11.10.0-12.9.el10_2
  • libvirt-daemon-log RHEL 10.2 11.10.0-12.9.el10_2

red hat advisories RHSA-2026:75583RHSA-2026:74424RHSA-2026:69131RHSA-2026:69114RHSA-2026:68594RHSA-2026:68513

  • libvirt SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 9.0.0-150500.6.29.1
  • libvirt SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 8.0.0-150400.7.17.1
  • libvirt SLE Module for Server Applications 15 SP7, SLE Module for Basesystem 15 SP7 11.0.0-150700.4.27.1
  • libvirt SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 11.4.0-160000.5.1
  • libvirt Linux Micro 6.0 10.0.0-5.1
  • libvirt Linux Micro 6.1 10.0.0-slfo.1.1_3.1
  • libvirt SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 5.1.0-13.48.1
  • libvirt SLES for SAP 15 SP6, SLES 15 SP6-LTSS 10.0.0-150600.8.18.1

suse advisories SUSE-SU-2026:4141-1SUSE-SU-2026:4010-1SUSE-SU-2026:4009-1SUSE-SU-2026:4004-1SUSE-SU-2026:3939-1SUSE-SU-2026:23460-1

  • libvirt openSUSE Leap 16.0 11.4.0-160000.5.1
  • libvirt openSUSE Tumbleweed 12.6.0-2.1

opensuse advisories openSUSE-SU-2026:21738-1openSUSE-SU-2026:11622-1

  • libvirt AlmaLinux 10 11.10.0-12.9.el10_2.alma.1
  • libvirt-nss AlmaLinux 10 11.10.0-12.9.el10_2.alma.1
  • libvirt-libs AlmaLinux 10 11.10.0-12.9.el10_2.alma.1
  • libvirt-client AlmaLinux 10 11.10.0-12.9.el10_2.alma.1
  • libvirt-daemon AlmaLinux 10 11.10.0-12.9.el10_2.alma.1
  • libvirt-ssh-proxy AlmaLinux 10 11.10.0-12.9.el10_2.alma.1
  • libvirt-daemon-kvm AlmaLinux 10 11.10.0-12.9.el10_2.alma.1
  • libvirt-daemon-log AlmaLinux 10 11.10.0-12.9.el10_2.alma.1

almalinux advisories ALSA-2026:75583ALSA-2026:74424

  • libvirt Rocky Linux 10 11.10.0-12.9.el10_2
  • libvirt Rocky Linux 9 11.10.0-12.7.el9_8

rocky linux advisories RLSA-2026:75583RLSA-2026:74424

  • libvirt Azure Linux 3.0 11.9.0-1

azure linux advisories AZL-97485

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18917 updated cvss 7.8

libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow

  • Red Hat Enterprise Linux 8 libvirt, libvirt-nss, libvirt-libs, libvirt-admin, libvirt-client, libvirt-daemon, +22 more
    affected: workaround, no fix available
  • Red Hat Enterprise Linux for NVIDIA 26 libvirt
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder EUS (v.9.6) libvirt-daemon-plugin-sanlock 10.10.0-7.19.el9_6
    fixed: vendor fix RHSA-2026:68511
  • Red Hat Enterprise Linux AppStream (v. 9) libvirt 11.10.0-12.7.el9_8, libvirt-nss 11.10.0-12.7.el9_8, libvirt-libs 11.10.0-12.7.el9_8, libvirt-client 11.10.0-12.7.el9_8, libvirt-daemon 11.10.0-12.7.el9_8, libvirt-ssh-proxy 11.10.0-12.7.el9_8, +23 more
    fixed: vendor fix RHSA-2026:74424
  • Red Hat Enterprise Linux AppStream (v. 10) libvirt 11.10.0-12.9.el10_2, libvirt-nss 11.10.0-12.9.el10_2, libvirt-libs 11.10.0-12.9.el10_2, libvirt-client 11.10.0-12.9.el10_2, libvirt-daemon 11.10.0-12.9.el10_2, libvirt-ssh-proxy 11.10.0-12.9.el10_2, +23 more
    fixed: vendor fix RHSA-2026:75583
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libnbd 1.2.2-1.module+el8.3.0+7353+9de0a3cc, netcf 0.2.8-12.module+el8.1.0+4066+0f1aadab, nbdfuse 1.2.2-1.module+el8.3.0+7353+9de0a3cc, nbdkit 1.16.2-4.module+el8.3.0+6922+fd575af8, hivex 1.3.18-21.module+el8.4.0+10770+19c037f9, seabios 1.13.0-2.module+el8.3.0+7353+9de0a3cc, +87 more
    fixed: vendor fix RHSA-2026:69131
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) libnbd 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, netcf 0.2.8-12.module+el8.6.0+14480+c0a3aa0f, hivex 1.3.18-23.module+el8.6.0+14480+c0a3aa0f, nbdfuse 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, nbdkit 1.24.0-4.module+el8.6.0+14480+c0a3aa0f, supermin 5.2.1-1.module+el8.6.0+14480+c0a3aa0f, +103 more
    fixed: vendor fix RHSA-2026:68594
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) libnbd 1.6.0-5.module+el8.8.0+16781+9f4724c2, netcf 0.2.8-12.module+el8.8.0+16781+9f4724c2, hivex 1.3.18-23.module+el8.8.0+16781+9f4724c2, nbdfuse 1.6.0-5.module+el8.8.0+16781+9f4724c2, nbdkit 1.24.0-5.module+el8.8.0+17308+05924798, SLOF 20210217-2.module+el8.8.0+20737+daad9f3b, +104 more
    fixed: vendor fix RHSA-2026:68513
show 12 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libvirt 9.0.0-10.17.el9_2, libvirt-nss 9.0.0-10.17.el9_2, libvirt-libs 9.0.0-10.17.el9_2, libvirt-client 9.0.0-10.17.el9_2, libvirt-daemon 9.0.0-10.17.el9_2, libvirt-daemon-kvm 9.0.0-10.17.el9_2, +16 more
    fixed: vendor fix RHSA-2026:68514
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) libvirt 10.0.0-6.24.el9_4, libvirt-nss 10.0.0-6.24.el9_4, libvirt-libs 10.0.0-6.24.el9_4, libvirt-client 10.0.0-6.24.el9_4, libvirt-daemon 10.0.0-6.24.el9_4, libvirt-daemon-kvm 10.0.0-6.24.el9_4, +22 more
    fixed: vendor fix RHSA-2026:68509
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libvirt 10.10.0-8.12.el10_0, libvirt-nss 10.10.0-8.12.el10_0, libvirt-libs 10.10.0-8.12.el10_0, libvirt-client 10.10.0-8.12.el10_0, libvirt-daemon 10.10.0-8.12.el10_0, libvirt-ssh-proxy 10.10.0-8.12.el10_0, +23 more
    fixed: vendor fix RHSA-2026:68510
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) libvirt 10.10.0-7.19.el9_6, libvirt-nss 10.10.0-7.19.el9_6, libvirt-libs 10.10.0-7.19.el9_6, libvirt-client 10.10.0-7.19.el9_6, libvirt-daemon 10.10.0-7.19.el9_6, libvirt-ssh-proxy 10.10.0-7.19.el9_6, +23 more
    fixed: vendor fix RHSA-2026:68511
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libnbd 1.2.2-1.module+el8.3.0+7353+9de0a3cc, netcf 0.2.8-12.module+el8.1.0+4066+0f1aadab, nbdfuse 1.2.2-1.module+el8.3.0+7353+9de0a3cc, nbdkit 1.16.2-4.module+el8.3.0+6922+fd575af8, hivex 1.3.18-21.module+el8.4.0+10770+19c037f9, seabios 1.13.0-2.module+el8.3.0+7353+9de0a3cc, +88 more
    fixed: vendor fix RHSA-2026:69131
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libnbd 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, netcf 0.2.8-12.module+el8.6.0+14480+c0a3aa0f, hivex 1.3.18-23.module+el8.6.0+14480+c0a3aa0f, nbdfuse 1.6.0-5.module+el8.6.0+14480+c0a3aa0f, nbdkit 1.24.0-4.module+el8.6.0+14480+c0a3aa0f, SLOF 20210217-1.module+el8.6.0+14480+c0a3aa0f, +104 more
    fixed: vendor fix RHSA-2026:68594
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) libnbd 1.6.0-5.module+el8.8.0+16781+9f4724c2, netcf 0.2.8-12.module+el8.8.0+16781+9f4724c2, hivex 1.3.18-23.module+el8.8.0+16781+9f4724c2, nbdfuse 1.6.0-5.module+el8.8.0+16781+9f4724c2, nbdkit 1.24.0-5.module+el8.8.0+17308+05924798, seabios 1.16.0-4.module+el8.8.0+19627+2d14cb21, +103 more
    fixed: vendor fix RHSA-2026:68513
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libvirt-daemon-plugin-sanlock 11.10.0-12.7.el9_8
    fixed: vendor fix RHSA-2026:74424
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libvirt-daemon-plugin-sanlock 11.10.0-12.9.el10_2
    fixed: vendor fix RHSA-2026:75583
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libvirt-daemon-plugin-sanlock 10.10.0-8.12.el10_0
    fixed: vendor fix RHSA-2026:68510
  • Red Hat Enterprise Linux Server (v. 7 ELS) libvirt 4.5.0-36.el7_9.7, libvirt-libs 4.5.0-36.el7_9.7, libvirt-client 4.5.0-36.el7_9.7, libvirt-daemon 4.5.0-36.el7_9.7, libvirt-daemon-kvm 4.5.0-36.el7_9.7, libvirt-bash-completion 4.5.0-36.el7_9.7, +18 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) libvirt-nss 4.5.0-36.el7_9.7, libvirt-admin 4.5.0-36.el7_9.7, libvirt-daemon-lxc 4.5.0-36.el7_9.7, libvirt-login-shell 4.5.0-36.el7_9.7, libvirt-lock-sanlock 4.5.0-36.el7_9.7
    fixed: vendor fix RHSA-2026:69114
  • Red Hat Enterprise Linux 6 libvirt, libvirt-client, libvirt-python, libvirt-lock-sanlock
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux for NVIDIA 26

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.