CVE-2026-61477: libvirt Virtual Network Driver RCE Flaw

CVE-2026-61477 Overview

CVE-2026-61477 is an injection vulnerability in the libvirt virtual network driver. The network XML parser fails to strip newline characters from Domain Name System (DNS) TXT record value attributes and SRV record domain and target attributes. Libvirt writes these values verbatim into the dnsmasq configuration file generated by the network driver. A user with permission to define virtual networks can inject arbitrary dnsmasq configuration directives, including dhcp-script, which leads to arbitrary command execution as root. The flaw is tracked under CWE-93: Improper Neutralization of CRLF Sequences.

Critical Impact
An authenticated local user with virtual network definition privileges can escalate to root code execution on the libvirt host through malicious DNS record attributes.

Affected Products

libvirt virtual network driver (upstream)
Red Hat Enterprise Linux distributions shipping affected libvirt packages
Any Linux distribution packaging vulnerable libvirt releases with the network driver enabled

Discovery Timeline

2026-08-07 - CVE-2026-61477 published to the National Vulnerability Database (NVD)
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-61477

Vulnerability Analysis

Libvirt defines virtual networks through XML documents that can specify DNS records, including TXT and SRV entries. The network driver serializes these definitions into a dnsmasq configuration file consumed by the DHCP and DNS service that backs the virtual network.

The XML parser accepts newline characters embedded inside TXT value attributes and SRV domain and target attributes. Because dnsmasq treats each line of its configuration file as a distinct directive, a newline injected into an attribute allows an attacker to append arbitrary configuration lines. Directives such as dhcp-script=/path/to/binary cause dnsmasq to execute the referenced binary as root when DHCP events occur.

Exploitation requires local access and the privileges needed to define or modify a virtual network through libvirt. On systems where non-root users are delegated network definition rights, the flaw enables privilege escalation to root. See the upstream fix in the GitLab Libvirt Commit and vendor tracking in the Red Hat CVE-2026-61477 advisory.

Root Cause

The network XML parser does not neutralize \n or \r characters before serializing DNS record attributes into the generated dnsmasq configuration file. This is a classic CRLF injection pattern that violates the trust boundary between XML input and line-oriented configuration output.

Attack Vector

An attacker with authenticated local access and libvirt network definition rights crafts a virtual network XML document containing a DNS TXT or SRV record whose attribute value embeds a newline followed by a malicious dnsmasq directive. When libvirt starts or reloads the network, dnsmasq reads the injected directive and executes attacker-controlled commands as root.

No verified public exploit code has been published. The vulnerability mechanism is described in prose above; refer to the Red Hat Bug Report #2512066 for additional technical detail.

Detection Methods for CVE-2026-61477

Indicators of Compromise

Presence of unexpected directives such as dhcp-script, dhcp-option, or conf-file in dnsmasq configuration files generated under /var/lib/libvirt/dnsmasq/
Libvirt network XML definitions whose <txt> value or <srv> domain/target attributes contain embedded newline or carriage return characters
Unexpected child processes spawned by dnsmasq running under the libvirt-managed instance, especially shells or interpreters executed as root

Detection Strategies

Audit virsh net-dumpxml output for every defined network and flag attribute values containing \n, \r, or other control characters
Compare running dnsmasq configurations under /var/lib/libvirt/dnsmasq/ against the network XML definitions to identify unexpected directives
Enable and review libvirt audit logs for net-define, net-create, and net-update operations performed by non-root principals

Monitoring Recommendations

Monitor process creation events for dnsmasq spawning child processes with root privileges outside the expected lease-handling scripts
Alert on file writes to /var/lib/libvirt/dnsmasq/ that occur outside of libvirt daemon activity
Track privilege changes and unexpected execve calls originating from libvirt-managed dnsmasq instances

How to Mitigate CVE-2026-61477

Immediate Actions Required

Apply the vendor-supplied libvirt update as soon as it is available for your distribution
Restrict the set of users and service accounts authorized to define or modify libvirt virtual networks to trusted administrators only
Review all existing network XML definitions and remove any DNS TXT or SRV records containing embedded newline or control characters

Patch Information

The upstream fix is committed in libvirt at 3cfc77963b512d809348fca07f97fe924fac9a05. The commit adds validation that rejects newline characters in DNS record attributes before writing the dnsmasq configuration file. Track distribution-specific package updates through the Red Hat CVE-2026-61477 advisory.

Workarounds

Remove libvirt network definition permissions from unprivileged users until the patch is deployed
Validate all network XML definitions with a pre-commit review that rejects control characters in DNS record attributes
Disable the libvirt network driver on hosts that do not require virtual DNS/DHCP services

bash

# Enumerate defined libvirt networks and inspect DNS record attributes for control characters
for net in $(virsh net-list --all --name); do
    echo "== $net =="
    virsh net-dumpxml "$net" | grep -E '<(txt|srv)' || true
done

# Restrict libvirt access to trusted administrators via PolicyKit or group membership
sudo gpasswd -d untrusted_user libvirt