HighFix available

Important: libvirt security, bug fix, and enhancement update

Type: advisorySource: OSV1 source record

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622) * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917) Bug Fix(es) and Enhancement(s): * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [rhel-9.8.z] (JIRA:Rocky Linux-186018) * libvirt-guests does not work together with virtlockd on shutdown [rhel-9.8.z] (JIRA:Rocky Linux-224986) * Expose guest-get-devices in libvirt-api [rhel-9.8.z] (JIRA:Rocky Linux-243306) * allow hyperv pvpanic "device" to process Windows crash dump [rhel-9.8.z] (JIRA:Rocky Linux-242549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Announced 3 Oct 2026Source revision 1

Original source ↗

RLSA-2026:74424

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:RLSA-2026:74424

libvirt

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 0:11.10.0-12.7.el9_8
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "0:11.10.0-12.7.el9_8"
          }
        ],
        "database_specific": {
          "yum_repository": "AppStream"
        }
      }
    ],
    "package": {
      "name": "libvirt",
      "purl": "pkg:rpm/rocky-linux/libvirt?distro=rocky-linux-9&epoch=0",
      "ecosystem": "Rocky Linux:9"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:74424.json"
    }
  }
]

Related CVEs: CVE-2026-18917
Source reference: /upstream
CVE-2026-63622
Source reference: /upstream

Publisher severity

high

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-18917 · High

Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux for NVIDIA 26

CVE-2026-63622 · High

Event: #75221 · Revision 1
Added to Heist Feed: Mon, 26 Oct 2026 03:38:27 GMT
Publisher date: Sat, 03 Oct 2026 12:04:21 GMT

Read the original announcement