libvirt - Debian Package Tracker

general

source: libvirt (main)
version: 12.9.0-1
maintainer: Debian Libvirt Maintainers (archive) (DMD)
uploaders: Andrea Bolognani (DMD) – Guido Günther (DMD)
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 7.0.0-3+deb11u3
o-o-sec: 7.0.0-3+deb11u4
o-o-p-u: 7.0.0-3+deb11u3
oldstable: 9.0.0-4+deb12u2
old-bpo: 11.3.0-2~bpo12+1
stable: 11.3.0-3+deb13u2
testing: 12.8.0-1
unstable: 12.9.0-1

versioned links

7.0.0-3+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.0.0-3+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
9.0.0-4+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
11.3.0-2~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
11.3.0-3+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.8.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.9.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnss-libvirt
libvirt-clients (14 bugs: 0, 10, 4, 0)
libvirt-clients-qemu
libvirt-common (1 bugs: 0, 0, 1, 0)
libvirt-daemon (54 bugs: 0, 44, 10, 0)
libvirt-daemon-common
libvirt-daemon-config-network
libvirt-daemon-config-nwfilter (1 bugs: 0, 1, 0, 0)
libvirt-daemon-driver-interface
libvirt-daemon-driver-lxc (1 bugs: 0, 1, 0, 0)
libvirt-daemon-driver-network
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-qemu (4 bugs: 0, 2, 2, 0)
libvirt-daemon-driver-secret
libvirt-daemon-driver-storage
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-iscsi-direct (1 bugs: 0, 1, 0, 0)
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-zfs
libvirt-daemon-driver-vbox
libvirt-daemon-driver-xen
libvirt-daemon-lock
libvirt-daemon-log
libvirt-daemon-plugin-lockd
libvirt-daemon-plugin-sanlock
libvirt-daemon-system (35 bugs: 0, 30, 5, 0)
libvirt-daemon-system-systemd (1 bugs: 0, 1, 0, 0)
libvirt-daemon-system-sysv
libvirt-dev
libvirt-doc
libvirt-l10n
libvirt-login-shell
libvirt-sanlock
libvirt-ssh-proxy
libvirt-wireshark
libvirt0 (14 bugs: 0, 14, 0, 0)

action needed

7 security issues in bookworm high

There are 7 open security issues in bookworm.

1 important issue:

CVE-2026-77159: A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

6 issues postponed or untriaged:

CVE-2025-12748: (needs triaging) A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.
CVE-2026-18917: (postponed; to be fixed through a stable update) A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
CVE-2026-61477: (postponed; to be fixed through a stable update) An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
CVE-2026-61478: (postponed; to be fixed through a stable update)
CVE-2026-63622: (postponed; to be fixed through a stable update) A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
CVE-2026-63623: (postponed; to be fixed through a stable update) A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

Created: 2026-09-12 Last update: 2026-11-10 05:30

6 security issues in bullseye high

There are 6 open security issues in bullseye.

5 important issues:

CVE-2026-18917: A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
CVE-2026-61477: An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
CVE-2026-61478:
CVE-2026-63622: A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
CVE-2026-63623: A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

1 issue postponed or untriaged:

CVE-2025-12748: (postponed; to be fixed through a stable update) A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.

Created: 2026-08-06 Last update: 2026-08-30 19:19

Depends on packages which need a new maintainer normal

The packages that libvirt depends on which need a new maintainer are:

systemtap (#1114760)
- Suggests: systemtap
- Build-Depends: systemtap-sdt-dev

Created: 2025-09-09 Last update: 2026-11-10 07:30

9 bugs with a patch to review in the bug tracker normal

The bug tracker contains patches fixing 9 bugs to review: include them, or remove the patch tag.

Created: 2026-09-02 Last update: 2026-11-10 06:30

8 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 52688fe3185d3743007ffb1b0eb79582b675a34b
Author: Andrea Bolognani <eof@kiyuko.org>
Date:   Tue Nov 3 23:49:43 2026 +0100

    Document changes and release 12.9.0-1

commit 7c882e24ee805899d52ace630b8109c153234688
Author: Andrea Bolognani <eof@kiyuko.org>
Date:   Tue Nov 3 21:12:51 2026 +0100

    not-installed: Skip logrotate config for modular daemons
    
    Gbp-Dch: Ignore

commit 7786b2f5faaff56144945334e840fac9133d6502
Author: Andrea Bolognani <eof@kiyuko.org>
Date:   Tue Nov 3 01:06:01 2026 +0100

    rules: Set meson options
    
    driver_secret has been renamed, the remaining ones are new.
    
    Gbp-Dch: Ignore

commit cb84941a7557e0312931efbcef1683ca79f9ad72
Author: Andrea Bolognani <eof@kiyuko.org>
Date:   Tue Nov 3 00:50:05 2026 +0100

    patches: Refresh patches
    
    Gbp-Dch: Ignore

commit 0801eaad799f337b3bab6daa6beec49aa426801e
Author: Andrea Bolognani <eof@kiyuko.org>
Date:   Tue Nov 3 00:48:10 2026 +0100

    symbols: Bump symbol versions
    
    No new public symbols.
    
    Gbp-Dch: Ignore

commit 335baee474964468ffca77e8ceaa0d3bfc967a15
Author: Andrea Bolognani <eof@kiyuko.org>
Date:   Tue Nov 3 00:47:55 2026 +0100

    changelog: Create entry for 12.9.0-1
    
    Gbp-Dch: Ignore

commit c6ac28f1dfa53e8794b7db92923e863b43c0aa97
Merge: 90c5fadd 965be210
Author: Andrea Bolognani <eof@kiyuko.org>
Date:   Tue Nov 3 00:45:57 2026 +0100

    Update upstream source from tag 'upstream/12.9.0'
    
    Update to upstream version '12.9.0'
    with Debian dir 747324ffb0b19bfed1495cf5f2d5b016b301327c

commit 965be210e082f2fa3ad0624dec9d50e5690df765
Author: Andrea Bolognani <eof@kiyuko.org>
Date:   Tue Nov 3 00:44:46 2026 +0100

    New upstream version 12.9.0

Created: 2026-11-05 Last update: 2026-11-10 04:17

4 open merge requests in Salsa normal

There are 4 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-10-01 Last update: 2026-11-09 22:01

lintian reports 24 warnings normal

Lintian reports 24 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-03 Last update: 2026-10-15 16:30

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-77159: (needs triaging) A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-09-12 Last update: 2026-11-10 05:30

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-04-23 Last update: 2026-10-04 09:16

testing migrations

excuses:
- Migrates after: ceph
- Migration status for libvirt (12.8.0-1 to 12.9.0-1): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
- Issues preventing migration:
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Piuparts check waiting for test results - https://piuparts.debian.org/sid/source/libv/libvirt.html
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Autopkgtest for libvirt/12.9.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Pass
- ∙ ∙ Lintian check waiting for test results - info
- ∙ ∙ Reproducibility check waiting for results on amd64 - info
- ∙ ∙ Reproducibility check waiting for results on i386 - info
- ∙ ∙ Too young, only 0 of 5 days old
- ∙ ∙ Depends: libvirt ceph (not considered)
- Additional info (not blocking):
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- Not considered

news

[rss feed]

[2026-11-09] Accepted libvirt 12.9.0-1 (source) into unstable (Andrea Bolognani)
[2026-10-07] libvirt 12.8.0-1 MIGRATED to testing (Debian testing watch)
[2026-10-03] Accepted libvirt 12.8.0-1 (source) into unstable (Andrea Bolognani)
[2026-09-08] libvirt 12.7.0-1 MIGRATED to testing (Debian testing watch)
[2026-09-05] Accepted libvirt 11.3.0-3+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrea Bolognani)
[2026-09-02] Accepted libvirt 12.7.0-1 (source) into unstable (Andrea Bolognani)
[2026-08-12] libvirt 12.6.0-1 MIGRATED to testing (Debian testing watch)
[2026-08-05] Accepted libvirt 12.6.0-1 (source) into unstable (Andrea Bolognani)
[2026-07-14] libvirt 12.5.0-1 MIGRATED to testing (Debian testing watch)
[2026-07-05] Accepted libvirt 12.5.0-1 (source) into unstable (Andrea Bolognani)
[2026-06-30] libvirt 12.4.0-1 MIGRATED to testing (Debian testing watch)
[2026-06-23] Accepted libvirt 12.4.0-1 (source) into unstable (Andrea Bolognani)
[2026-05-29] libvirt 12.3.0-1 MIGRATED to testing (Debian testing watch)
[2026-05-18] Accepted libvirt 12.3.0-1 (source) into unstable (Andrea Bolognani)
[2026-04-25] libvirt 12.2.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-22] Accepted libvirt 12.2.0-1 (source) into unstable (Andrea Bolognani)
[2026-03-31] Accepted libvirt 12.1.0-1 (source) into experimental (Andrea Bolognani)
[2026-03-19] Accepted libvirt 7.0.0-3+deb11u4 (source) into oldoldstable-security (Utkarsh Gupta)
[2026-01-20] libvirt 12.0.0-1 MIGRATED to testing (Debian testing watch)
[2026-01-18] Accepted libvirt 12.0.0-1 (source) into unstable (Andrea Bolognani)
[2026-01-01] Accepted libvirt 11.3.0-3+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrea Bolognani)
[2025-12-14] Accepted libvirt 11.10.0-2 (source) into experimental (Andrea Bolognani)
[2025-12-13] libvirt 11.10.0-1 MIGRATED to testing (Debian testing watch)
[2025-12-03] Accepted libvirt 11.10.0-1 (source) into unstable (Andrea Bolognani)
[2025-11-12] libvirt 11.9.0-2 MIGRATED to testing (Debian testing watch)
[2025-11-08] Accepted libvirt 11.9.0-2 (source) into unstable (Andrea Bolognani)
[2025-11-07] libvirt 11.9.0-1 MIGRATED to testing (Debian testing watch)
[2025-11-04] Accepted libvirt 11.9.0-1 (source) into unstable (Andrea Bolognani)
[2025-11-02] Accepted libvirt 11.3.0-3+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrea Bolognani)
[2025-10-28] libvirt 11.8.0-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 198 202
RC: 0
I&N: 151 155
M&W: 47
F&P: 0
patch: 9

links

homepage
lintian (0, 24)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, 41)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 12.6.0-1ubuntu4
139 bugs (5 patches)
patches for 12.6.0-1ubuntu4