Back Linuxsecurity

Ubuntu 26.04 LTS libvirt Critical Local Privilege Escalation CVE-2026

Linuxsecurity •LinuxSecurity Advisories • September 28, 2026

CISA confirms exploitation of a Linux firewall flaw. Check if your systems need the fix. ×

Several security issues were fixed in libvirt. Software Description: - libvirt: Libvirt virtualization toolkit Details: It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-18917) It was discovered that libvirt did not correctly handle symbolic links when changing ownership of the TPM emulator log file. A local attacker with access to the swtpm account could possibly use this issue to cause libvirt to change the ownership of an arbitrary file. (CVE-2026-77159)

Several security issues were fixed in libvirt.

Software Description:

- libvirt: Libvirt virtualization toolkit

It was discovered that libvirt had an integer overflow vulnerability in

the NodeGetFreePages RPC handler. A local attacker could possibly use

this issue to cause a denial of service or execute arbitrary code.

It was discovered that libvirt did not correctly handle symbolic links

when changing ownership of the TPM emulator log file. A local attacker

with access to the swtpm account could possibly use this issue to cause libvirt

to change the ownership of an arbitrary file. (CVE-2026-77159)

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libvirt-daemon 12.0.0-1ubuntu5.5 libvirt-daemon-system 12.0.0-1ubuntu5.5 libvirt0 12.0.0-1ubuntu5.5 Ubuntu 24.04 LTS libvirt-daemon 10.0.0-2ubuntu8.19 libvirt-daemon-system 10.0.0-2ubuntu8.19 libvirt0 10.0.0-2ubuntu8.19 Ubuntu 22.04 LTS libvirt-daemon 8.0.0-1ubuntu7.21 libvirt-daemon-system 8.0.0-1ubuntu7.21 libvirt0 8.0.0-1ubuntu7.21 After a standard system update you need to reboot your computer to make all the necessary changes.

CVE-2026-18917, CVE-2026-77159

Ubuntu Security Notice USN-8831-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Libvirt Vulnerabilities in Ubuntu 26.04 LTS Exploited Multiple security vulnerabilities have been identified in the libvirt virtualization toolkit affecting Ubuntu 26.04 LTS. Key issues include a local privilege escalation vulnerability (CVE-2026-18917) and a symlink-following vulnerability (CVE-2026-77159), which could allow attackers to execute arbitrary code or change file ownership. CISA has confirmed exploitation of these vulnerabilities in the wild. Administrators are urged to apply patches immediately to mitigate risks. The vulnerabilities impact systems running libvirt versions 12.0.0-1ubuntu5.5. Users are advised to update their systems and reboot to ensure all changes take effect. The vulnerabilities were disclosed in August and September 2026, with the most recent patch released on September 11, 2026. 2 sources 72

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (2)

CVE-2026-18917 CVE-2026-77159