CVE-2026-18917: Integer Overflow or Wraparound in Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

The vulnerability in libvirt involves an integer overflow in the NodeGetFreePages RPC handler, which allows crafted input to bypass size validation, resulting in an undersized heap buffer. This buffer overflow enables overwriting of real NUMA node data and corruption of the root libvirt daemon's memory space. The flaw can be exploited by an unprivileged local user to cause denial of service or escalate privileges locally. Red Hat has released security updates for affected products, including Red Hat Enterprise Linux 9.4 variants, to fix this issue.

Successful exploitation of this vulnerability can lead to denial of service by crashing the libvirt daemon or local privilege escalation by corrupting its memory. The vulnerability affects the confidentiality, integrity, and availability of the system as indicated by the CVSS score of 7.8 with high impact on all three security properties.

Red Hat has released security updates that fix this vulnerability. Users should apply the libvirt package updates provided in Red Hat Security Advisory RHSA-2026:68509. Details and instructions for applying the update are available at https://access.redhat.com/articles/11258. Applying these official patches fully mitigates the vulnerability.