Red Hat Security Advisory

RHSA-2026:68513

virt:rhel security update

Released 2026-09-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.8.8) SLOF-20210217-2.module+el8.8.0+20737+daad9f3b.noarch::virt:rhel, SLOF-20210217-2.module+el8.8.0+20737+daad9f3b.src::virt:rhel, hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.ppc64le::virt:rhel +47
Red Hat Enterprise Linux AppStream TUS (v.8.8) hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.src::virt:rhel, hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.x86_64::virt:rhel, hivex-devel-1.3.18-23.module+el8.8.0+16781+9f4724c2.x86_64::virt:rhel +47

Fixes 3 records

TI-2026-45271 CVE-2026-63622 · GHSA-r329-fjhj-3cw3

Libvirt: swtpm privilege escalation via symlink following

LOW 35

A flaw was found in libvirt.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00142 Published 2026-08-10 Partial fix · 11.10.0-12.9.el10_2, 10.10.0-8.11.el10_0 +8 CWE-59

TI-2026-15469 CVE-2026-18917 · GHSA-6jq9-9f7w-h7mc

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

LOW 35

A flaw was found in libvirt.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00182 Published 2026-08-20 Partial fix · 11.10.0-12.9.el10_2, 10.10.0-8.12.el10_0 +8 CWE-190

TI-2025-10288 CVE-2025-11234 · GHSA-hm8v-8c3v-cxfq

Qemu-kvm: vnc websocket handshake use-after-free

LOW 34

A flaw was found in QEMU.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00864 Published 2025-10-03 Partial fix · 10.1.2, 18:10.0.0-14.el10_1.5 +13 CWE-416