A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

ubuntu_linux USN-8652-1: Ubuntu 14.04 LTS / Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu 26.04 LTS / Ubuntu Pro Realtime 22.04 LTS / Ubuntu Pro Realtime 24.04 LTS : libvirt vulnerabilities (USN-8652-1)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4004-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4009-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4010-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0978 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-63623:
    A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the qemu-img utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines.

    CVE-2026-63622:
    A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user,     could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a     symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation     from the swtpm sandbox to root-level file ownership control.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory.

    libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection     (CVE-2026-61477)

    libvirt: Check for empty string condition and skip inclusion of the XML document context in the error     message. (CVE-2026-61478)

    A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm`     user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a     symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation     from the `swtpm` sandbox to root-level file ownership control. (CVE-2026-63622)

    A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines. (CVE-2026-63623)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines. (CVE-2026-63623)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348452	SUSE SLES15: libvirt / libvirt-client / libvirt-daemon / etc (SUSE-SU-2026:4004-1)	Nessus	SuSE Local Security Checks	Local	high
348448	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4009-1)	Nessus	SuSE Local Security Checks	Local	high
348414	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4010-1)	Nessus	SuSE Local Security Checks	Local	high
344405	TencentOS Server 4: libvirt (TSSA-2026:0978)	Nessus	Tencent Local Security Checks	Local	high
341892	Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)	Nessus	Amazon Linux Local Security Checks	Local	high
334402	Linux Distros Unpatched Vulnerability : CVE-2026-63623	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-63623

medium

Tenable Plugins

Coming Soon

high

high

high

high

high

medium