Detections
Analytics

CentOS Linux 7 [TuxCare] Security Update: libvirt / libvirt-admin / libvirt-bash-completion / libvirt-client / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1790705830)

medium Nessus Plugin ID 362899

Synopsis

The CentOS Linux host is missing one or more security updates.

Description

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1790705830 advisory.

 - A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
 (CVE-2021-3631)

 - A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash. (CVE-2021-3975)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1790705830.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1790705830

http://www.nessus.org/u?cf0a992f

Plugin Details

Severity: Medium

ID: 362899

File Name: tuxcare_centos_7_CLSA-2026-1790705830.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/4/2026

Updated: 10/4/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

Vendor

Vendor Severity: Moderate

CVSS v2

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.6

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2021-3631

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.7

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/OS/extended-third-party, Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/29/2026

Vulnerability Publication Date: 11/17/2020

Reference Information

CVE: CVE-2021-3631, CVE-2021-3975

CLSA: 2026:1790705830