CVE-2026-82327: libsolv Out-of-Bounds Write DOS Vulnerability

CVE-2026-82327 Overview

A flaw exists in libsolv, the dependency-resolution library used by RPM-based package managers including dnf, yum, and zypper. The library rewrites .solv repository cache files without validating directory-id values read from compressed filelist data. A corrupted or specially crafted .solv cache file triggers an out-of-bounds memory write when the package manager next processes it. The condition can occur naturally after an unclean shutdown that leaves the cache in a torn state. Exploitation results in a crash of the affected tool. Arbitrary code execution is not expected because the out-of-bounds write stores a fixed, non-attacker-controlled value. The weakness is classified as [CWE-129] Improper Validation of Array Index.

Critical Impact
Local denial of service against dnf, yum, or zypper when they process a malformed .solv cache file, disrupting package management operations on RPM-based systems.

Affected Products

libsolv dependency-resolution library
RPM-based package managers using libsolv (dnf, yum, zypper)
Linux distributions shipping affected libsolv builds (see Red Hat CVE-2026-82327 Advisory)

Discovery Timeline

2026-08-28 - CVE CVE-2026-82327 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82327

Vulnerability Analysis

The vulnerability resides in the .solv cache rewrite path within libsolv. Package managers such as dnf and zypper use .solv files as a binary cache of repository metadata to accelerate dependency resolution. During rewrite, libsolv parses compressed filelist data that includes directory-id references pointing into an internal directory table.

The library reads these directory-id values from the file and uses them as array indices without confirming they fall within the valid range. A directory-id outside the expected bounds causes the code to write to memory outside the intended buffer, producing an out-of-bounds write.

The written value is fixed by the code path and is not influenced by attacker-controlled data in the cache file. This constrains the outcome to memory corruption that crashes the process. The result is a local denial of service against the package management tool, which requires user interaction to run.

Root Cause

The root cause is missing bounds validation on directory-id values decoded from the compressed filelist section of a .solv file. The affected code trusts values read from disk and uses them as indices during the cache rewrite operation, matching the [CWE-129] pattern.

Attack Vector

Exploitation requires a malformed .solv file to be present in a location read by the package manager, typically under /var/cache/dnf, /var/cache/yum, or /var/cache/zypp. The malformed file may arrive through an unclean shutdown that truncates the cache, corruption on disk, or a locally staged file. A user or automated job then runs a package manager operation that triggers a rewrite of the cache, causing the crash.

The vulnerability manifests during .solv cache rewrite. Refer to the Red Hat Bug Report #2525602 for upstream analysis and patch tracking.

Detection Methods for CVE-2026-82327

Indicators of Compromise

Repeated crashes of dnf, yum, or zypper processes recorded in system logs or systemd-coredump artifacts
Presence of truncated or malformed .solv files under /var/cache/dnf, /var/cache/yum, or /var/cache/zypp
Package management operations failing immediately after an unclean shutdown or storage error

Detection Strategies

Monitor for abnormal termination signals (SIGSEGV, SIGABRT) originating from package manager binaries
Correlate core dump events with recent modifications to .solv cache files
Alert on repeated failures of scheduled dnf or zypper refresh jobs across a fleet

Monitoring Recommendations

Ingest journald and systemd-coredump events into a central log store for cross-host correlation
Track file integrity of .solv caches on production hosts where package operations are automated
Review audit logs for unexpected writes to package manager cache directories by non-root processes

How to Mitigate CVE-2026-82327

Immediate Actions Required

Apply distribution-provided libsolv updates once available from your vendor
Delete existing .solv cache files and force a clean rebuild using dnf clean all or zypper clean --all
Prioritize patching on systems that run automated package management from untrusted or shared storage

Patch Information

Patch availability is tracked by distribution maintainers. Consult the Red Hat CVE-2026-82327 Advisory and the Red Hat Bug Report #2525602 for fixed package versions. Apply vendor updates through the standard package management channel once released.

Workarounds

Remove or rebuild .solv cache files after any unclean shutdown before running package operations
Restrict write access to package manager cache directories to the root user only
Avoid running package manager operations against caches sourced from untrusted systems or backups

bash

# Clear and rebuild dnf/zypper caches to eliminate malformed .solv files
sudo dnf clean all && sudo dnf makecache
sudo zypper clean --all && sudo zypper refresh