CVE-2026-18917 is an integer overflow vulnerability in the NodeGetFreePages RPC handler of libvirt on Red Hat Enterprise Linux 10. Crafted values can bypass a size check, leading to an undersized heap buffer that is subsequently overwritten by real NUMA node data. This heap buffer overflow corrupts the root libvirt daemon's memory, which may cause denial of service or enable local privilege escalation by an unprivileged local user. The vulnerability requires local access and low privileges but no user interaction. The vulnerability has a CVSS v3.1 score of 7.8 (high severity).

The vulnerability allows an unprivileged local user to cause memory corruption in the root libvirt daemon, potentially leading to denial of service (crash or restart) or local privilege escalation. Confidentiality, integrity, and availability impacts are all rated high due to the possibility of executing unauthorized code or commands and bypassing protection mechanisms.

Red Hat recommends restricting access to the libvirt read-only Unix socket by setting unix_sock_ro_perms to "0770" or "0700" and configuring unix_sock_group to a trusted group in /etc/libvirt/libvirtd.conf. Alternatively, enable polkit authentication for the read-only socket by setting auth_unix_ro = "polkit" to require authorization before RPC dispatch. After configuration changes, restart the libvirtd service. Note that restricting socket access may prevent unprivileged monitoring or read-only management tools from connecting. No official patch status is provided; check the Red Hat advisory for updates.