Database/Kernel, userspace & hypervisor
libvirt: negative array length in RPC deserialization crashes libvirtd
Impact
The RPC server allocates memory for arrays before the C API entry points validate that the length is non-negative, so a negative length reaches g_new0 as a huge positive value and the daemon aborts. A local unprivileged user who can reach the libvirt socket can take down libvirtd at will. On a virtualized GPU host that means losing the management plane for every guest on the node - no start, stop, migrate or vGPU reconfiguration until the daemon is back - while the running guests themselves continue. For an operator the cost is that automated draining and live migration, the cheap way to empty a GPU node, stop working exactly when they are needed.
Who can reach it
A local, unprivileged user with access to the libvirt socket on the hypervisor host. No authentication beyond socket access is required.
What to do
Update libvirt via the vendor errata (RHSA-2024:2560, RHSA-2024:3253) and restart the libvirt daemons. Restarting libvirtd does not stop running domains, so this is a daemon restart on each hypervisor rather than a node drain or reboot; expect a short window where management calls fail.
References
Related entries
- libvirt: race in the RPC client event loop gives a stack use-after-free reachable through virtproxydCVE-2024-4418 · libvirt virtNetClientIOEventLoop (stack use-after-free in the RPC client path, reachable via virtproxyd)Medium
- libvirt: zero-byte allocation corner case lets read-only clients crash virtinterfacedCVE-2024-8235 · libvirt virtinterfaced (NULL dereference in the interface-listing APIs)Medium
- QEMU e1000: guest-triggered stack overflow in the loopback receive path crashes the host QEMU processCVE-2025-12464 · QEMU e1000 network device (e1000_receive_iov loopback path)Medium
- Linux kernel (drivers/iommu): The ARM long-descriptor unmap path returns a negative errno through an unsigned size_tCVE-2026-23067 · Linux kernel (drivers/iommu)Medium
- Linux kernel (drivers/pci): Tearing down a PF that still has SR-IOV VFs takes pci_rescan_remove_lock recursively andCVE-2026-43147 · Linux kernel (drivers/pci)Medium
- Linux kernel (drivers/iommu/iommufd): A failed copy_to_user while draining the iommufd fault queue restarts the sameCVE-2026-64290 · Linux kernel (drivers/iommu/iommufd)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.