libvirt - Debian Package Tracker

general

source: libvirt (main)
version: 12.7.0-1
maintainer: Debian Libvirt Maintainers (archive) (DMD)
uploaders: Andrea Bolognani [DMD] – Guido Günther [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 7.0.0-3+deb11u3
o-o-sec: 7.0.0-3+deb11u4
o-o-p-u: 7.0.0-3+deb11u3
oldstable: 9.0.0-4+deb12u2
old-bpo: 11.3.0-2~bpo12+1
stable: 11.3.0-3+deb13u2
testing: 12.6.0-1
unstable: 12.7.0-1

versioned links

7.0.0-3+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.0.0-3+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
9.0.0-4+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
11.3.0-2~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
11.3.0-3+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.2.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.6.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.7.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnss-libvirt
libvirt-clients (14 bugs: 0, 10, 4, 0)
libvirt-clients-qemu
libvirt-common (1 bugs: 0, 0, 1, 0)
libvirt-daemon (55 bugs: 0, 45, 10, 0)
libvirt-daemon-common
libvirt-daemon-config-network
libvirt-daemon-config-nwfilter (1 bugs: 0, 1, 0, 0)
libvirt-daemon-driver-interface
libvirt-daemon-driver-lxc (1 bugs: 0, 1, 0, 0)
libvirt-daemon-driver-network
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-qemu (5 bugs: 0, 3, 2, 0)
libvirt-daemon-driver-secret
libvirt-daemon-driver-storage
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-iscsi-direct (1 bugs: 0, 1, 0, 0)
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-zfs
libvirt-daemon-driver-vbox
libvirt-daemon-driver-xen
libvirt-daemon-lock
libvirt-daemon-log
libvirt-daemon-plugin-lockd
libvirt-daemon-plugin-sanlock
libvirt-daemon-system (33 bugs: 0, 28, 5, 0)
libvirt-daemon-system-systemd (1 bugs: 0, 1, 0, 0)
libvirt-daemon-system-sysv
libvirt-dev
libvirt-doc
libvirt-l10n
libvirt-login-shell
libvirt-sanlock
libvirt-ssh-proxy
libvirt-wireshark
libvirt0 (14 bugs: 0, 14, 0, 0)

action needed

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-18917: A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.

Created: 2026-08-22 Last update: 2026-09-03 08:01

6 security issues in bookworm high

There are 6 open security issues in bookworm.

5 important issues:

CVE-2026-18917: A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
CVE-2026-61477: An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
CVE-2026-61478:
CVE-2026-63622: A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
CVE-2026-63623: A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

1 issue postponed or untriaged:

CVE-2025-12748: (needs triaging) A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.

Created: 2026-08-06 Last update: 2026-09-03 08:01

6 security issues in bullseye high

There are 6 open security issues in bullseye.

5 important issues:

CVE-2026-18917: A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
CVE-2026-61477: An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
CVE-2026-61478:
CVE-2026-63622: A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
CVE-2026-63623: A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

1 issue postponed or untriaged:

CVE-2025-12748: (postponed; to be fixed through a stable update) A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.

Created: 2026-08-06 Last update: 2026-08-30 19:19

8 bugs tagged patch in the BTS normal

The BTS contains patches fixing 8 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-09-04 00:00

Depends on packages which need a new maintainer normal

The packages that libvirt depends on which need a new maintainer are:

systemtap (#1114760)
- Suggests: systemtap
- Build-Depends: systemtap-sdt-dev

Created: 2025-09-09 Last update: 2026-09-03 23:01

lintian reports 4 warnings normal

Lintian reports 4 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-03 Last update: 2026-09-03 09:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-04-23 Last update: 2026-08-06 14:30

testing migrations

excuses:
- Migration status for libvirt (12.6.0-1 to 12.7.0-1): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
- Issues preventing migration:
- ∙ ∙ Missing build on amd64
- ∙ ∙ Missing build on i386
- ∙ ∙ Missing build on ppc64el
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Autopkgtest deferred on amd64: missing arch:amd64 build
- ∙ ∙ Autopkgtest deferred on i386: missing arch:i386 build
- ∙ ∙ Autopkgtest deferred on ppc64el: missing arch:ppc64el build
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Autopkgtest for apparmor/4.1.8-1: arm64: Test triggered, armhf: Failed (not a regression) ♻ (reference ♻)
- ∙ ∙ Autopkgtest for cockpit-machines/356-1: arm64: Test triggered, armhf: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for fence-agents/4.17.0-1: arm64: Test triggered, armhf: Pass
- ∙ ∙ Autopkgtest for golang-github-libvirt-libvirt-go/6.0.0+git20200210.224cad8-2: arm64: Test triggered, armhf: Failed (not a regression) ♻ (reference ♻)
- ∙ ∙ Autopkgtest for libguestfs: arm64: Test triggered
- ∙ ∙ Autopkgtest for libsys-virt-perl/12.6.0-1: arm64: Test triggered, armhf: Pass
- ∙ ∙ Autopkgtest for libvirt/12.7.0-1: arm64: Test triggered, armhf: Pass
- ∙ ∙ Autopkgtest for libvirt-dbus/1.4.1-4: arm64: Test triggered, armhf: Failed (not a regression) ♻ (reference ♻)
- ∙ ∙ Autopkgtest for libvirt-glib/5.0.0-4: arm64: Test triggered, armhf: Pass
- ∙ ∙ Autopkgtest for libvirt-python/12.6.0-1: arm64: Test triggered, armhf: Pass
- ∙ ∙ Autopkgtest for munin-libvirt-plugins/0.0.7-1.2: arm64: Test triggered, armhf: No tests, superficial or marked flaky ♻
- ∙ ∙ Autopkgtest for nova/2:33.0.1-5: arm64: Test triggered, armhf: No tests, superficial or marked flaky ♻
- ∙ ∙ Autopkgtest for oz/0.17.0-7: arm64: Test triggered, armhf: No tests, superficial or marked flaky ♻
- ∙ ∙ Autopkgtest for prometheus-libvirt-exporter: arm64: Test triggered
- ∙ ∙ Autopkgtest for ruby-libvirt/0.8.4-1: arm64: Test triggered, armhf: Pass
- ∙ ∙ Autopkgtest for virt-manager/1:5.1.0-2: arm64: Test triggered, armhf: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for virt-top/1.1.1-2: arm64: Test triggered, armhf: Pass
- ∙ ∙ Lintian check waiting for test results on amd64, ppc64el, riscv64, i386 - info
- ∙ ∙ Reproducibility check deferred on amd64: missing builds - info
- ∙ ∙ Reproducibility check deferred on i386: missing builds - info
- ∙ ∙ Too young, only 1 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/libv/libvirt.html
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- Not considered

news

[rss feed]

[2026-09-02] Accepted libvirt 12.7.0-1 (source) into unstable (Andrea Bolognani)
[2026-08-12] libvirt 12.6.0-1 MIGRATED to testing (Debian testing watch)
[2026-08-05] Accepted libvirt 12.6.0-1 (source) into unstable (Andrea Bolognani)
[2026-07-14] libvirt 12.5.0-1 MIGRATED to testing (Debian testing watch)
[2026-07-05] Accepted libvirt 12.5.0-1 (source) into unstable (Andrea Bolognani)
[2026-06-30] libvirt 12.4.0-1 MIGRATED to testing (Debian testing watch)
[2026-06-23] Accepted libvirt 12.4.0-1 (source) into unstable (Andrea Bolognani)
[2026-05-29] libvirt 12.3.0-1 MIGRATED to testing (Debian testing watch)
[2026-05-18] Accepted libvirt 12.3.0-1 (source) into unstable (Andrea Bolognani)
[2026-04-25] libvirt 12.2.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-22] Accepted libvirt 12.2.0-1 (source) into unstable (Andrea Bolognani)
[2026-03-31] Accepted libvirt 12.1.0-1 (source) into experimental (Andrea Bolognani)
[2026-03-19] Accepted libvirt 7.0.0-3+deb11u4 (source) into oldoldstable-security (Utkarsh Gupta)
[2026-01-20] libvirt 12.0.0-1 MIGRATED to testing (Debian testing watch)
[2026-01-18] Accepted libvirt 12.0.0-1 (source) into unstable (Andrea Bolognani)
[2026-01-01] Accepted libvirt 11.3.0-3+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrea Bolognani)
[2025-12-14] Accepted libvirt 11.10.0-2 (source) into experimental (Andrea Bolognani)
[2025-12-13] libvirt 11.10.0-1 MIGRATED to testing (Debian testing watch)
[2025-12-03] Accepted libvirt 11.10.0-1 (source) into unstable (Andrea Bolognani)
[2025-11-12] libvirt 11.9.0-2 MIGRATED to testing (Debian testing watch)
[2025-11-08] Accepted libvirt 11.9.0-2 (source) into unstable (Andrea Bolognani)
[2025-11-07] libvirt 11.9.0-1 MIGRATED to testing (Debian testing watch)
[2025-11-04] Accepted libvirt 11.9.0-1 (source) into unstable (Andrea Bolognani)
[2025-11-02] Accepted libvirt 11.3.0-3+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrea Bolognani)
[2025-10-28] libvirt 11.8.0-2 MIGRATED to testing (Debian testing watch)
[2025-10-18] Accepted libvirt 11.8.0-2 (source) into unstable (Andrea Bolognani)
[2025-10-10] libvirt 11.8.0-1 MIGRATED to testing (Debian testing watch)
[2025-10-07] Accepted libvirt 11.8.0-1 (source) into unstable (Andrea Bolognani)
[2025-09-06] libvirt 11.7.0-1 MIGRATED to testing (Debian testing watch)
[2025-09-02] Accepted libvirt 11.7.0-1 (source) into unstable (Andrea Bolognani)

bugs [bug history graph]

all: 197 201
RC: 0
I&N: 150 154
M&W: 47
F&P: 0
patch: 8

links

homepage
lintian (0, 4)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, 39)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 12.6.0-1ubuntu1
10 bugs (1 patch)
patches for 12.6.0-1ubuntu1