libvirt: integer overflow in NodeGetFreePages gives a local user heap corruption in the root daemon

Impact

An integer overflow in the NodeGetFreePages RPC handler lets crafted values bypass a size check, so real NUMA node data is written into an undersized buffer inside the root libvirt daemon. Red Hat describes the outcome as denial of service or local privilege escalation. On a virtualization host running vGPU or PCI-passthrough guests, libvirtd runs as root and owns the device assignments, so escalation there is escalation to the hypervisor host. Even the DoS case is expensive: losing libvirtd does not kill running guests but it kills your ability to manage them — no migration, no clean drain — which turns a routine node evacuation into a hard reboot. Red Hat lists RHEL 6 through 10 and RHEL for NVIDIA 26 among affected products.

Who can reach it

An unprivileged local user on the hypervisor host who can reach the libvirt socket and call the NodeGetFreePages API. Local and authenticated; the record describes no remote path.

What to do

Red Hat tracks fixes on its CVE page and Bugzilla 2520161; no fixed package version is stated in the record, so take the version from the errata when it lands for your stream. Applying it means updating libvirt and restarting libvirtd — running guests survive a libvirtd restart, but management operations in flight are interrupted, so avoid doing it mid-migration. No guest reboot and no node drain required.

References