<security-notice xmlns="http://security.libvirt.org/xmlns/security-notice/1.0">
  <id>2026-0007</id>

  <summary>double free of a pointer in qemuAgentGetDisks</summary>

  <description>
<![CDATA[When processing of the disk data returned by the guest agent from the
         guest failed, hitting the cleanup label, the disks array
         was freed but the pointer was not cleared, leading
         to a possible double free.]]>
  </description>

  <impact>
<![CDATA[Malicious guest OS can crash the libvirt daemon.]]>
  </impact>

  <workaround>
<![CDATA[Disable guest agent for utrusted guests]]>
  </workaround>

  <credits>
    <reporter>
      <name>David Korczynski (Ada Logics)</name>
      <email></email>
    </reporter>
    <patcher>
      <name>Ján Tomko</name>
      <email>jtomko@redhat.com</email>
    </patcher>
  </credits>

  <lifecycle>
    <reported>20260819</reported>
    <published>20260824</published>
    <fixed>20260824</fixed>
  </lifecycle>

  <reference>
    <advisory type="CVE" id="2026-77158"/>
    <bug tracker="libvirt" id="910"/>
  </reference>

  <product name="libvirt">
    <repository>libvirt.git</repository>
    <branch>
      <name>master</name>
      <tag state="vulnerable">v7.0.0</tag>
      <tag state="vulnerable">v7.1.0</tag>
      <tag state="vulnerable">v7.2.0</tag>
      <tag state="vulnerable">v7.3.0</tag>
      <tag state="vulnerable">v7.4.0</tag>
      <tag state="vulnerable">v7.5.0</tag>
      <tag state="vulnerable">v7.6.0</tag>
      <tag state="vulnerable">v7.7.0</tag>
      <tag state="vulnerable">v7.8.0</tag>
      <tag state="vulnerable">v7.9.0</tag>
      <tag state="vulnerable">v7.10.0</tag>
      <tag state="vulnerable">v8.0.0</tag>
      <tag state="vulnerable">v8.1.0</tag>
      <tag state="vulnerable">v8.2.0</tag>
      <tag state="vulnerable">v8.3.0</tag>
      <tag state="vulnerable">v8.4.0</tag>
      <tag state="vulnerable">v8.5.0</tag>
      <tag state="vulnerable">v8.6.0</tag>
      <tag state="vulnerable">v8.7.0</tag>
      <tag state="vulnerable">v8.8.0</tag>
      <tag state="vulnerable">v8.9.0</tag>
      <tag state="vulnerable">v8.10.0</tag>
      <tag state="vulnerable">v9.0.0</tag>
      <tag state="vulnerable">v9.1.0</tag>
      <tag state="vulnerable">v9.2.0</tag>
      <tag state="vulnerable">v9.3.0</tag>
      <tag state="vulnerable">v9.4.0</tag>
      <tag state="vulnerable">v9.5.0</tag>
      <tag state="vulnerable">v9.6.0</tag>
      <tag state="vulnerable">v9.7.0</tag>
      <tag state="vulnerable">v9.8.0</tag>
      <tag state="vulnerable">v9.9.0</tag>
      <tag state="vulnerable">v9.10.0</tag>
      <tag state="vulnerable">v10.0.0</tag>
      <tag state="vulnerable">v10.1.0</tag>
      <tag state="vulnerable">v10.2.0</tag>
      <tag state="vulnerable">v10.3.0</tag>
      <tag state="vulnerable">v10.4.0</tag>
      <tag state="vulnerable">v10.5.0</tag>
      <tag state="vulnerable">v10.6.0</tag>
      <tag state="vulnerable">v10.7.0</tag>
      <tag state="vulnerable">v10.8.0</tag>
      <tag state="vulnerable">v10.9.0</tag>
      <tag state="vulnerable">v10.10.0</tag>
      <tag state="vulnerable">v11.0.0</tag>
      <tag state="vulnerable">v11.1.0</tag>
      <tag state="vulnerable">v11.2.0</tag>
      <tag state="vulnerable">v11.3.0</tag>
      <tag state="vulnerable">v11.4.0</tag>
      <tag state="vulnerable">v11.5.0</tag>
      <tag state="vulnerable">v11.6.0</tag>
      <tag state="vulnerable">v11.7.0</tag>
      <tag state="vulnerable">v11.8.0</tag>
      <tag state="vulnerable">v11.9.0</tag>
      <tag state="vulnerable">v11.10.0</tag>
      <tag state="vulnerable">v12.0.0</tag>
      <tag state="vulnerable">v12.1.0</tag>
      <tag state="vulnerable">v12.2.0</tag>
      <tag state="vulnerable">v12.3.0</tag>
      <tag state="vulnerable">v12.4.0</tag>
      <tag state="vulnerable">v12.5.0</tag>
      <tag state="vulnerable">v12.6.0</tag>
      <change state="vulnerable">0cb2d9f05d00497a715352f6ea28cf8fb6921731</change>
      <tag state="fixed">v12.7.0</tag>
      <change state="fixed">9d3adf8db6da40a2e5966ca44989eedddc71a2f7</change>
    </branch>
  </product>

</security-notice>
