Integer Overflow Vulnerability in libvirt NodeGetFreePages RPC Handler

A vulnerability (CVE-2026-18917) has been identified in the libvirt daemon, specifically within the NodeGetFreePages RPC handler. This integer overflow flaw permits an unprivileged local user to provide crafted input that bypasses existing size validation checks, resulting in the allocation of an undersized memory buffer. Subsequent operations to populate this buffer with Non-Uniform Memory Access (NUMA) node data lead to a heap-based buffer overflow. This corruption of the libvirt daemon's memory, which typically runs with root privileges, can be leveraged by an attacker to induce a denial-of-service condition or facilitate local privilege escalation on the host system.

Attack Chain

1. Attacker establishes a local session on the target Linux system as an unprivileged user.
2. Attacker interacts with the libvirt daemon via the public libvirt API or RPC interface.
3. Attacker initiates a call to the NodeGetFreePages RPC handler.
4. Attacker submits malicious parameters designed to trigger an integer overflow during size calculation.
5. The daemon logic bypasses the security bounds check due to the overflowed integer.
6. The daemon allocates a heap buffer that is smaller than the required space for the NUMA data.
7. The daemon writes NUMA data into the heap buffer, causing an out-of-bounds write.
8. Attacker leverages the resulting memory corruption to escalate privileges to the context of the libvirt daemon process.

Impact

Successful exploitation of this vulnerability enables a local attacker to escalate privileges to root on the affected host, potentially allowing for full system compromise. The vulnerability affects multiple versions of Red Hat Enterprise Linux and the core libvirt package. Given the high-privilege nature of the libvirt daemon in virtualization environments, this flaw represents a significant risk to host integrity and workload isolation.

Recommendation

• Identify all systems running vulnerable versions of libvirt.
• Apply security patches provided by Red Hat as soon as they become available for the affected RHEL versions.
• Restrict access to the libvirt RPC interface to only trusted users and administrative accounts.
• Monitor logs for unusual libvirt daemon crashes or instability, which may indicate exploitation attempts.