CVE-2026-9150: libsolv Buffer Overflow Vulnerability

CVE-2026-9150 Overview

CVE-2026-9150 is a stack-based buffer overflow [CWE-121] in libsolv, an open-source library used for dependency resolution in package management systems. The flaw resides in the Debian metadata parser when handling repository metadata containing crafted SHA384 or SHA512 checksum tags. An attacker who convinces a user to process a malicious Debian repository can trigger memory corruption, resulting in denial of service. libsolv is widely embedded in package managers including DNF, Zypper, and other RPM-based tooling, expanding the exposure beyond Debian-native systems that consume Debian metadata.

Critical Impact

Processing crafted Debian repository metadata triggers a stack buffer overflow in libsolv, corrupting memory and crashing the host process that performs package resolution.

Affected Products

• libsolv (openSUSE upstream project)
• Red Hat Enterprise Linux distributions shipping libsolv
• openSUSE and SUSE Linux Enterprise distributions shipping libsolv

Discovery Timeline

• 2026-05-20 - CVE-2026-9150 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-9150

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in libsolv's Debian repository metadata parser. When libsolv parses repository index files, it processes checksum entries declared with tags such as SHA384 and SHA512. The parser writes checksum data into a fixed-size stack buffer without correctly enforcing the bounds required for these longer hash lengths. A crafted entry overflows the buffer and corrupts adjacent stack memory, including saved registers and the return address. The condition requires user interaction, typically a package operation that fetches and parses the malicious repository metadata. Successful exploitation produces a process crash and denial of service of the package management workflow. Confidentiality and integrity remain unaffected per the published CVSS vector, but availability impact is high.

Root Cause

The libsolv Debian backend uses fixed-size stack storage sized for shorter checksum tags. The parser does not validate that the checksum tag length matches the destination buffer before copying bytes from the repository file. SHA384 and SHA512 digests exceed the assumed maximum, allowing the overflow. The upstream fix is tracked in openSUSE Pull Request #616.

Attack Vector

An attacker hosts a malicious Debian repository or performs a man-in-the-middle modification of repository metadata served over an unauthenticated channel. When a user or automation runs a package operation that consumes that repository, libsolv parses the crafted SHA384 or SHA512 checksum tag and overflows the stack buffer. The attack vector is network-based but requires user-initiated package processing. No authentication is required on the target system. The vulnerability mechanism is described in the Red Hat CVE-2026-9150 Advisory and Red Hat Bug Report #2460379.

Detection Methods for CVE-2026-9150

Indicators of Compromise

• Unexpected crashes or SIGSEGV terminations of processes linking libsolv, including dnf, zypper, microdnf, or packagekitd.
• Core dumps from package management tools containing stack frames inside libsolv Debian repository parsing routines.
• Outbound connections from package managers to untrusted or unexpected Debian repository hosts.

Detection Strategies

• Inspect repository configuration files such as /etc/apt/sources.list, /etc/yum.repos.d/, and /etc/zypp/repos.d/ for unauthorized Debian repository entries.
• Alert on libsolv-linked processes terminating abnormally during repository refresh or transaction resolution.
• Compare installed libsolv package versions against vendor-fixed versions across the fleet.

Monitoring Recommendations

• Forward package manager logs and system crash telemetry to a centralized analytics platform for anomaly review.
• Monitor changes to repository definition files and GPG keyring directories used by package managers.
• Track network egress from build systems and container image pipelines that invoke libsolv-based tooling.

How to Mitigate CVE-2026-9150

Immediate Actions Required

• Apply distribution-provided libsolv updates as soon as vendor packages become available.
• Restrict package management operations to trusted, authenticated, and TLS-protected repositories only.
• Audit container base images and CI runners that invoke libsolv, and rebuild them once a patched library is published.

Patch Information

The upstream fix is implemented in openSUSE Pull Request #616. Track distribution-specific advisories through the Red Hat CVE-2026-9150 Advisory and the corresponding Red Hat Bug Report #2460379 for backported package versions.

Workarounds

• Disable Debian repository sources in libsolv-based tooling until the patched library is installed.
• Enforce repository signature verification and pin trusted mirrors to prevent injection of crafted metadata.
• Run package operations in isolated, non-privileged environments so that a crash does not affect production workloads.

# Configuration example: verify installed libsolv version and disable untrusted repos
rpm -q libsolv          # RHEL / openSUSE
dpkg -l | grep libsolv  # Debian / Ubuntu derivatives

# Temporarily disable a suspect repository (DNF example)
sudo dnf config-manager --set-disabled <repo-id>

# Force repository metadata refresh after patching
sudo dnf clean all && sudo dnf makecache