libvirt: storage pool lookup race lets read-only clients crash libvirtd

Impact

virStoragePoolObjListSearch returns a pool without holding its lock, which creates a race. A client connected only to libvirt's read-only socket can use it to crash the libvirt daemon. On a GPU virtualization host, that takes away VM management (start, stop, migrate, device passthrough changes) until the daemon is back. The record describes denial of service only, with no confidentiality or integrity impact.

Who can reach it

Any client allowed to connect to libvirt's read-only socket. Low-privilege authentication is needed, and attack complexity is high (race). This is local unless libvirt remote access is exposed over the network.

What to do

Install the fixed libvirt package from your distribution (Red Hat: RHSA-2023:6409) and restart libvirtd. The record does not list an upstream fixed version. Until patched, limit who can reach the read-only socket.

References

Related entries

• Linux kernel (drivers/pci): When the kernel coalesces two adjacent host-bridge apertures it invalidates the absorbedCVE-2023-53814 · Linux kernel (drivers/pci)Medium
• AMD SEV-SNP (BadRAM): BadRAM: improper validation of DIMM SPD metadata lets an attacker with physical access or ring0CVE-2024-21944 · AMD SEV-SNP (BadRAM)Medium
• fail2ban: sshd filter parses the logged username as an address, letting a remote attacker ban arbitrary IPsCVE-2026-109786 · fail2ban sshd filter (config/filter.d/sshd.conf)Medium
• OpenSSL QUIC: missing connection-level flow control lets a peer force ~100MB of heap per connectionCVE-2026-75804 · OpenSSL QUIC stack (connection-level flow control)Medium
• OpenSSL CMP client: NULL dereference when revoking a certificate by PKCS#10 CSRCVE-2026-75805 · OpenSSL CMP client (revocation-by-CSR response handling)Medium
• libuser: direct /etc/passwd rewrites can corrupt the account database and chain to local rootCVE-2015-3246 · libuser / usermode userhelper (/etc/passwd modification on RHEL)Medium