Red Hat Fixes Two libvirt Flaws on RHEL 7 ELS
Tech GuruQuick Answer
Red Hat published RHSA-2026:69114 for CVE-2026-18917 and CVE-2026-63622 in the RHEL 7 Extended Lifecycle Support libvirt stream. Red Hat rates the update Important, assigns both vulnerabilities a 7.8 High CVSS v3.1 score, and provides fixed build 4.5.0-36.el7_9.7.
Update Entitled RHEL 7 ELS Virtualization Hosts
What to do now: Identify RHEL 7 ELS hosts with libvirt packages, confirm the exact entitlement and installed NVR, apply the fixed Red Hat build, and validate guest, storage, network, migration, management, and recovery workflows.
Last verified: 2026-09-21 UTC. Recheck the current authoritative advisory and entitled repository before changing production.
Scope And Authority
| Product scope | RHEL 7 Extended Lifecycle Support libvirt |
|---|---|
| Advisory | RHSA-2026:69114 |
| CVEs | CVE-2026-18917, CVE-2026-63622 |
| Authoritative release date | 2026-09-21 04:11:21 UTC |
| Authority revision date | 2026-09-21 04:11:56 UTC |
| Affected versions | RHEL 7 ELS libvirt packages before 4.5.0-36.el7_9.7 |
| Fixed version | libvirt 4.5.0-36.el7_9.7 |
| CVSS base score | 7.8 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by Red Hat; no exploitation claim is inferred. |
What Changed
The advisory supplies branch-specific libvirt package fixes for two vulnerabilities rated 7.8 High. Red Hat's authoritative CVE records define the detailed preconditions and impact; the advisory does not state active exploitation and does not make every RHEL virtualization host affected by default.
What To Validate Now
- Inventory. Locate entitled RHEL 7 ELS systems with libvirt packages and record host, cluster, hypervisor, guest, management, storage, and network ownership.
- Establish applicability. Match each host to the RHEL 7 ELS advisory stream and exact libvirt NVR; review the vulnerability conditions in Red Hat's linked CVE records before assigning local exposure.
- Remediate. Update libvirt and installed companion packages to 4.5.0-36.el7_9.7 or a supported superseding RHEL 7 ELS build through the entitled repository.
- Validate. Confirm all installed libvirt package NVRs and follow Red Hat activation guidance; test representative guest start, stop, migration, storage, networking, monitoring, and rollback paths.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
RHEL 7 ELS is a specific lifecycle entitlement. Coordinate changes with virtualization and application owners, preserve console and rollback options, and do not substitute an upstream libvirt version for Red Hat's package NVR mapping.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, source advisory revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
