A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3932 advisory.

    A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a     path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access     to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to     transfer ownership of an arbitrary file to the swtpm user. (CVE-2026-77159)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8831-1 advisory.

    It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler.
    A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2026-18917)

    It was discovered that libvirt did not correctly handle symbolic links when changing ownership of the TPM     emulator log file. A local attacker with access to the swtpm account could possibly use this issue to     cause libvirt to change the ownership of an arbitrary file. (CVE-2026-77159)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4004-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4009-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4010-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a     path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access     to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to     transfer ownership of an arbitrary file to the swtpm user. (CVE-2026-77159)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
351045	Amazon Linux 2 : libvirt (ALAS-2026-3932)	Nessus	Amazon Linux Local Security Checks	Local	medium
350949	Ubuntu 24.04 LTS : libvirt vulnerabilities (USN-8831-1)	Nessus	Ubuntu Local Security Checks	Local	high
348452	SUSE SLES15: libvirt / libvirt-client / libvirt-daemon / etc (SUSE-SU-2026:4004-1)	Nessus	SuSE Local Security Checks	Local	high
348448	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4009-1)	Nessus	SuSE Local Security Checks	Local	high
348414	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4010-1)	Nessus	SuSE Local Security Checks	Local	high
344762	Linux Distros Unpatched Vulnerability : CVE-2026-77159	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-77159

medium

Tenable Plugins

medium

high

high

high

high

medium