Libvirt Security Notice: LSN-2026-0002 ====================================== Summary: integer overflow in RPC handler for virNodeGetFreePages Reported on: 20260804 Published on: 20260812 Fixed on: 20260812 Reported by: Ada Logics <> Anthropic Research <> Patched by: Peter Krempa See also: CVE-2026-18917 Description ----------- The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages' argument with the 'cellcount' argument passed to 'virNodeGetFreePages', both of which are declared as 'unsigned int' to both do an RPC limit check against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate the memory to hold the result from the actual hypervisor driver. Since both the values are 'unsigned int' the product is also unsigned int so big enough numbers can overflow, both passing the check and also allocating not enough memory for the result. The hypervisor driver assumes that the passed buffer is large enough and overwrites memory. When this happens the the hypervisor daemon crashes. This can be triggered e.g. by passing 1023 and 4198405 as values which multiply to 1019 after wrapping to 32 bit unsigned value. Impact ------ Unprivileged users can cause the libvirt daemon to crash by writing beyond the end of the buffer Workaround ---------- None Affected product ---------------- Name: libvirt Repository: https://gitlab.com/libvirt/libvirt Branch: master Broken in: v1.2.6 Broken in: v1.2.7 Broken in: v1.2.8 Broken in: v1.2.9 Broken in: v1.2.10 Broken in: v1.2.11 Broken in: v1.2.12 Broken in: v1.2.13 Broken in: v1.2.14 Broken in: v1.2.15 Broken in: v1.2.16 Broken in: v1.2.17 Broken in: v1.2.18 Broken in: v1.2.19 Broken in: v1.2.20 Broken in: v1.2.21 Broken in: v1.3.0 Broken in: v1.3.1 Broken in: v1.3.2 Broken in: v1.3.3 Broken in: v1.3.4 Broken in: v1.3.5 Broken in: v2.0.0 Broken in: v2.1.0 Broken in: v2.2.0 Broken in: v2.3.0 Broken in: v2.4.0 Broken in: v2.5.0 Broken in: v3.0.0 Broken in: v3.1.0 Broken in: v3.2.0 Broken in: v3.3.0 Broken in: v3.4.0 Broken in: v3.5.0 Broken in: v3.6.0 Broken in: v3.7.0 Broken in: v3.8.0 Broken in: v3.9.0 Broken in: v3.10.0 Broken in: v4.0.0 Broken in: v4.1.0 Broken in: v4.2.0 Broken in: v4.3.0 Broken in: v4.4.0 Broken in: v4.5.0 Broken in: v4.6.0 Broken in: v4.7.0 Broken in: v4.8.0 Broken in: v4.9.0 Broken in: v4.10.0 Broken in: v5.0.0 Broken in: v5.1.0 Broken in: v5.2.0 Broken in: v5.3.0 Broken in: v5.4.0 Broken in: v5.5.0 Broken in: v5.6.0 Broken in: v5.7.0 Broken in: v5.8.0 Broken in: v5.9.0 Broken in: v5.10.0 Broken in: v6.0.0 Broken in: v6.1.0 Broken in: v6.2.0 Broken in: v6.3.0 Broken in: v6.4.0 Broken in: v6.5.0 Broken in: v6.6.0 Broken in: v6.7.0 Broken in: v6.8.0 Broken in: v6.9.0 Broken in: v6.10.0 Broken in: v7.0.0 Broken in: v7.1.0 Broken in: v7.2.0 Broken in: v7.3.0 Broken in: v7.4.0 Broken in: v7.5.0 Broken in: v7.6.0 Broken in: v7.7.0 Broken in: v7.8.0 Broken in: v7.9.0 Broken in: v7.10.0 Broken in: v8.0.0 Broken in: v8.1.0 Broken in: v8.2.0 Broken in: v8.3.0 Broken in: v8.4.0 Broken in: v8.5.0 Broken in: v8.6.0 Broken in: v8.7.0 Broken in: v8.8.0 Broken in: v8.9.0 Broken in: v8.10.0 Broken in: v9.0.0 Broken in: v9.1.0 Broken in: v9.2.0 Broken in: v9.3.0 Broken in: v9.4.0 Broken in: v9.5.0 Broken in: v9.6.0 Broken in: v9.7.0 Broken in: v9.8.0 Broken in: v9.9.0 Broken in: v9.10.0 Broken in: v10.0.0 Broken in: v10.1.0 Broken in: v10.2.0 Broken in: v10.3.0 Broken in: v10.4.0 Broken in: v10.5.0 Broken in: v10.6.0 Broken in: v10.7.0 Broken in: v10.8.0 Broken in: v10.9.0 Broken in: v10.10.0 Broken in: v11.0.0 Broken in: v11.1.0 Broken in: v11.2.0 Broken in: v11.3.0 Broken in: v11.4.0 Broken in: v11.5.0 Broken in: v11.6.0 Broken in: v11.7.0 Broken in: v11.8.0 Broken in: v11.9.0 Broken in: v11.10.0 Broken in: v12.0.0 Broken in: v12.1.0 Broken in: v12.2.0 Broken in: v12.3.0 Broken in: v12.4.0 Broken in: v12.5.0 Broken in: v12.6.0 Fixed in: v12.7.0 Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Fixed by: 5a62cbf2907d4590283597b46da9c0f41e7b4d4f Branch: v1.2.6-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.7-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.8-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.9-maint Broken in: v1.2.9.1 Broken in: v1.2.9.2 Broken in: v1.2.9.3 Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.10-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.11-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.12-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.13-maint Broken in: v1.2.13.1 Broken in: v1.2.13.2 Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.14-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.15-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.16-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.17-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.18-maint Broken in: v1.2.18.1 Broken in: v1.2.18.2 Broken in: v1.2.18.3 Broken in: v1.2.18.4 Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.19-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.20-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.2.21-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.3.0-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.3.1-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.3.2-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.3.3-maint Broken in: v1.3.3.1 Broken in: v1.3.3.2 Broken in: v1.3.3.3 Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.3.4-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v1.3.5-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v2.0-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v2.1-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v2.2-maint Broken in: v2.2.1 Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v3.0-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v3.2-maint Broken in: v3.2.1 Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v3.7-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.1-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.2-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.3-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.4-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.5-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.6-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.7-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.8-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.9-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v4.10-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v5.0-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v5.1-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v5.1.0-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v5.2-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b Branch: v5.3-maint Broken by: 34f2d0319d2098c77c8cc27d8350616029125a2b