A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

ubuntu_linux USN-8652-1: Ubuntu 14.04 LTS / Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu 26.04 LTS / Ubuntu Pro Realtime 22.04 LTS / Ubuntu Pro Realtime 24.04 LTS : libvirt vulnerabilities (USN-8652-1)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4004-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4009-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4010-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69114 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69131 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

    * virt:rhel/libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * virt:rhel/libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68594 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68513 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

    * virt:rhel/libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * virt:rhel/libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917 )

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106768 advisory.

    A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm`     user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a     symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation     from the `swtpm` sandbox to root-level file ownership control.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0978 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-63623:
    A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the qemu-img utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines.

    CVE-2026-63622:
    A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user,     could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a     symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation     from the swtpm sandbox to root-level file ownership control.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65803 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65516 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65515 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    Bug Fix(es) and Enhancement(s):

    * libvirt-guests does not work together with virtlockd on shutdown [rhel-9.6.z] (JIRA:RHEL-224985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64773 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory.

    libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection     (CVE-2026-61477)

    libvirt: Check for empty string condition and skip inclusion of the XML document context in the error     message. (CVE-2026-61478)

    A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm`     user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a     symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation     from the `swtpm` sandbox to root-level file ownership control. (CVE-2026-63622)

    A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines. (CVE-2026-63623)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm`     user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a     symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation     from the `swtpm` sandbox to root-level file ownership control. (CVE-2026-63622)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348452	SUSE SLES15: libvirt / libvirt-client / libvirt-daemon / etc (SUSE-SU-2026:4004-1)	Nessus	SuSE Local Security Checks	Local	high
348448	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4009-1)	Nessus	SuSE Local Security Checks	Local	high
348414	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4010-1)	Nessus	SuSE Local Security Checks	Local	high
348381	RHEL 7 : libvirt (RHSA-2026:69114)	Nessus	Red Hat Local Security Checks	Local	high
348376	RHEL 8 : virt:rhel (RHSA-2026:69131)	Nessus	Red Hat Local Security Checks	Local	high
346923	RHEL 8 : virt:rhel (RHSA-2026:68594)	Nessus	Red Hat Local Security Checks	Local	high
346854	RHEL 8 : virt:rhel (RHSA-2026:68513)	Nessus	Red Hat Local Security Checks	Local	high
344433	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvirt (UTSA-2026-106768)	Nessus	Unity Linux Local Security Checks	Local	high
344405	TencentOS Server 4: libvirt (TSSA-2026:0978)	Nessus	Tencent Local Security Checks	Local	high
343986	RHEL 9 : libvirt (RHSA-2026:65803)	Nessus	Red Hat Local Security Checks	Local	high
343894	RHEL 9 : libvirt (RHSA-2026:65516)	Nessus	Red Hat Local Security Checks	Local	high
343876	RHEL 9 : libvirt (RHSA-2026:65515)	Nessus	Red Hat Local Security Checks	Local	high
343816	RHEL 10 : libvirt (RHSA-2026:64773)	Nessus	Red Hat Local Security Checks	Local	high
341892	Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)	Nessus	Amazon Linux Local Security Checks	Local	high
334437	Linux Distros Unpatched Vulnerability : CVE-2026-63622	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-63622

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high