Ubuntu USN-8831-1 Fixes libvirt Vulnerabilities

Quick Answer

USN-8831-1 fixes libvirt issues on Ubuntu 22.04, 24.04, and 26.04. Canonical requires a reboot after updating. Plan guest availability and host recovery before maintenance; updating the package without completing that reboot is not the full documented procedure.

Last verified: 2026-09-28 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	libvirt vulnerabilities on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy)
Advisory	USN-8831-1
CVEs	CVE-2026-18917, CVE-2026-77159
Authoritative release date	2026-09-28 11:48:10.869424 UTC
Authority revision date	No separate material revision date is stated by Ubuntu; verified against the first-party notice API.
Affected versions	The Ubuntu releases and source packages enumerated in USN-8831-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy).
Fixed version	jammy: libvirt 8.0.0-1ubuntu7.21 / noble: libvirt 10.0.0-2ubuntu8.19 / resolute: libvirt 12.0.0-1ubuntu5.5
CVSS base score	Not provided by the authority
CVSS severity	Not provided by the authority
Exploitation status	Not stated by the authority; no exploitation claim is inferred.

What Changed

CVE-2026-18917 involves an integer overflow in the NodeGetFreePages RPC handler, with possible local denial of service or code execution. CVE-2026-77159 concerns symbolic-link handling that can let the swtpm user change file ownership outside the intended path. These are different local trust boundaries.

What To Validate Now

1. Inventory. Record the Ubuntu release, enabled repositories, installed binary packages (including libvirt-daemon, libvirt-daemon-system, and libvirt0 where installed), running consumers, and service owner. Check bundled application copies and container images separately.
2. Establish applicability. Compare installed binary packages with USN-8831-1's release-specific package table. The source-package builds summarized above identify the advisory's source release; they are not literal package-install commands.
3. Remediate. Follow Canonical's current update instructions for the affected binary packages on this Ubuntu release. Confirm security or Pro/ESM repository access as applicable. Do not install a source-package name merely because it appears in the summary table.
4. Validate. After the required reboot, confirm package versions, daemon health, guest startup, virtual networking, storage pools, and TPM-backed guests where used. Verify normal management access and review unexpected ownership changes separately from routine service testing.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Some listed fixes are delivered through Ubuntu Pro or ESM. Confirm entitlement and repository state before the change, use the exact supported release stream, and test dependent services, clusters, and rollback. Severity alone is not evidence of exploitation.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• USN-8831-1

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.