Issued at: 2026-10-06
Updated at: 2026-10-06
Advisory content derived from Red Hat RHSA-2026:75583, © Red Hat, Inc., used under CC BY 4.0, with modifications.
Synopsis
Important: libvirt security, bug fix, and enhancement update
Description
The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.
Security Fix(es):
* libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)
* libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917)
Bug Fix(es) and Enhancement(s):
* Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [rhel-10.2.z] (JIRA:Rocky Linux-186019)
* virsh dumpxml missing one SCSI disk when VMware VM has 64 disks per controller [rhel-10.2.z] (JIRA:Rocky Linux-191267)
* libvirt-guests does not work together with virtlockd on shutdown [rhel-10.2.z] (JIRA:Rocky Linux-224982)
* Expose guest-get-devices in libvirt-api [rhel-10.2.z] (JIRA:Rocky Linux-243305)
* allow hyperv pvpanic "device" to process Windows crash dump [rhel-10.2.z] (JIRA:Rocky Linux-242547)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.