USN-8833-1: libvirt vulnerabilities
Ubuntu patches libvirt flaws including CVE-2026-61477, letting local attackers with network-definition rights inject dnsmasq config and execute commands as root.
Ubuntu USN-8833-1 fixes multiple libvirt vulnerabilities. CVE-2026-61477 stems from improper validation of newline characters in DNS TXT record values and SRV record attributes, allowing a local attacker permitted to define virtual networks to inject arbitrary dnsmasq configuration directives and achieve arbitrary command execution as root. CVE-2026-61478 involves improper error handling during XML context parsing that can crash libvirt, causing denial of service. He Wei also discovered a symlink-following vulnerability in the file ownership change function.
- CVE-2026-61477 enables dnsmasq config injection and root command execution by local attackers
- Requires attacker permission to define virtual networks, limiting exposure to local privilege escalation
- CVE-2026-61478 causes libvirt crash and denial of service via XML parsing errors
- Symlink-following flaw in file ownership change function also patched
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-61477 | libvirt's virtual network driver: The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target… | 2.3 | <1% | ||
| CVE-2026-61478 | — | — | — |
From the original article
It was discovered that libvirt did not properly validate newline characters in DNS TXT record values and SRV record attributes in its virtual network driver. A local attacker with permission to define virtual networks could possibly use this issue to inject arbitrary dnsmasq configuration directives, leading to arbitrary command execution as root.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.