USN-8831-1: libvirt vulnerabilities
Ubuntu patched two local libvirt flaws: a possible code-execution overflow and a TPM log symlink bug.
Ubuntu Security Notice USN-8831-1 covers two local libvirt vulnerabilities. CVE-2026-18917 is an integer overflow in the NodeGetFreePages RPC handler that a local attacker could use for denial of service or arbitrary code execution. CVE-2026-77159 is improper symbolic-link handling when changing ownership of the TPM emulator log, letting a local user with swtpm access redirect that ownership change to an arbitrary file. No exploitation in the wild is reported.
- CVE-2026-18917: integer overflow in NodeGetFreePages may allow local denial of service or code execution.
- CVE-2026-77159: a swtpm user can abuse a symlink so libvirt changes ownership of an arbitrary file.
- Both issues need local access; the notice does not report active exploitation.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18917 | libvirt: An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows… | 7.8 | <1% | ||
| CVE-2026-77159 | Symlink-following chown flaw in libvirt swtpm logs | 5.5 | — |
From the original article
It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-18917) It was discovered that libvirt did not correctly handle symbolic links when changing ownership of the TPM emulator log file.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.