libvirt-11.10.0-17.el9

- conf: schemas: Allow '.' in schema for CPU flag name (RHEL-222551)
- tests: capabilityschemadata: Add a real test example (RHEL-222551)
- util: virFileChownFiles: do not follow symlinks (CVE-2026-63622)

Resolves: RHEL-222551, RHEL-235940

libvirt-conf-schemas-Allow-.-in-schema-for-CPU-flag-name.patch

@@ -0,0 +1,38 @@
+From 0c8a9769c18f6da3a91e6186833710d32a8f26d6 Mon Sep 17 00:00:00 2001
+Message-ID: <0c8a9769c18f6da3a91e6186833710d32a8f26d6.1786713428.git.jdenemar@redhat.com>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Mon, 3 Aug 2026 14:53:25 +0200
+Subject: [PATCH] conf: schemas: Allow '.' in schema for CPU flag name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Allow '.' so that CPU features such as:
+
+ <feature name='sse4.1'/>
+
+pass schema validation.
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit 5225c1cb688170bb2748f2f23455da4a7cb8a1bf)
+https://redhat.atlassian.net/browse/RHEL-222551
+---
+ src/conf/schemas/cputypes.rng | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/conf/schemas/cputypes.rng b/src/conf/schemas/cputypes.rng
+index 8edf1d14e3..eef3807f1a 100644
+--- a/src/conf/schemas/cputypes.rng
++++ b/src/conf/schemas/cputypes.rng
+@@ -406,7 +406,7 @@
+           <element name="feature">
+             <attribute name="name">
+               <data type="string">
+-                <param name="pattern">[a-zA-Z0-9\-_]+</param>
++                <param name="pattern">[a-zA-Z0-9\-_.]+</param>
+               </data>
+             </attribute>
+             <empty/>
+-- 
+2.55.0

libvirt-util-virFileChownFiles-do-not-follow-symlinks.patch

@@ -0,0 +1,71 @@
+From b71d798b0e6fb719ae6c05ccf02fc0a3f7e57e6a Mon Sep 17 00:00:00 2001
+Message-ID: <b71d798b0e6fb719ae6c05ccf02fc0a3f7e57e6a.1786713428.git.jdenemar@redhat.com>
+From: =?UTF-8?q?HE=20WEI=EF=BC=88=E3=82=AE=E3=82=AB=E3=82=AF=EF=BC=89?=
+ <skyexpoc@gmail.com>
+Date: Tue, 28 Jul 2026 17:49:02 +0100
+Subject: [PATCH] util: virFileChownFiles: do not follow symlinks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+virFileChownFiles() selected entries with virFileIsRegular() (stat(), follows
+symlinks) and changed ownership with chown() (follows symlinks). A component
+that owns the target directory at a lower privilege (e.g. the swtpm/tss state
+directory) can plant a symlink to an arbitrary regular file and have the root
+caller chown that file. Use lstat() to skip non-regular entries and
+fchownat(..., AT_SYMLINK_NOFOLLOW) so a symlink final component is never
+followed.
+
+Fixes: CVE-2026-63622
+Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
+[DB: use g_lstat instead of stat; use lchown instead of
+ fchownat for portability; added comment]
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 801160fd414ca2cc402bc01ead09b7ed4c3b8f5b)
+Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
+---
+ src/util/virfile.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/src/util/virfile.c b/src/util/virfile.c
+index 05b2fa8168..4fbb306a78 100644
+--- a/src/util/virfile.c
++++ b/src/util/virfile.c
+@@ -3179,6 +3179,12 @@ int virDirIsEmpty(const char *path,
+  *
+  * Change ownership of all regular files in a directory.
+  *
++ * This will NOT follow any symlinks, to avoid security risks.
++ * It is assumed the process using content under @name will
++ * be unprivileged, thus less trusted than libvirt. If it is
++ * compromised it might attempt to create symlinks in @name to
++ * escalate privileges on a subsequent call to virFileChownFiles.
++ *
+  * Returns -1 on error, with error already reported, 0 on success.
+  */
+ #ifndef WIN32
+@@ -3195,13 +3201,19 @@ int virFileChownFiles(const char *name,
+ 
+     while ((direrr = virDirRead(dir, &ent, name)) > 0) {
+         g_autofree char *path = NULL;
++        struct stat sb;
+ 
+         path = g_build_filename(name, ent->d_name, NULL);
+ 
+-        if (!virFileIsRegular(path))
++        if (g_lstat(path, &sb) < 0) {
++            virReportSystemError(errno, _("cannot stat '%1$s'"), path);
++            return -1;
++        }
++
++        if (!S_ISREG(sb.st_mode))
+             continue;
+ 
+-        if (chown(path, uid, gid) < 0) {
++        if (lchown(path, uid, gid) < 0) {
+             virReportSystemError(errno,
+                                  _("cannot chown '%1$s' to (%2$u, %3$u)"),
+                                  ent->d_name, (unsigned int) uid,
+-- 
+2.55.0

libvirt.spec

@@ -294,7 +294,7 @@
 Summary: Library providing a simple virtualization API
 Name: libvirt
 Version: 11.10.0
-Release: 16%{?dist}%{?extra_release}
+Release: 17%{?dist}%{?extra_release}
 License: GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1
 URL: https://libvirt.org/
 
@@ -442,6 +442,9 @@ Patch137: libvirt-qemuValidateDomainDeviceDefVideo-Fix-checks-of-virtio-video-de
 Patch138: libvirt-qemuDeviceVideoGetModel-Remove-logic-for-selecting-virtio-devices.patch
 Patch139: libvirt-qemuDeviceVideoGetModel-Simplify-by-relying-on-checks-from-qemuValidateDomainDeviceDefVideo.patch
 Patch140: libvirt-qemu-Remove-qemuDomainSupportsVideoVga.patch
+Patch141: libvirt-conf-schemas-Allow-.-in-schema-for-CPU-flag-name.patch
+Patch142: libvirt-tests-capabilityschemadata-Add-a-real-test-example.patch
+Patch143: libvirt-util-virFileChownFiles-do-not-follow-symlinks.patch
 
 
 Requires: libvirt-daemon = %{version}-%{release}
@@ -2833,6 +2836,11 @@ exit 0
 %endif
 
 %changelog
+* Fri Aug 14 2026 Jiri Denemark <jdenemar@redhat.com> - 11.10.0-17
+- conf: schemas: Allow '.' in schema for CPU flag name (RHEL-222551)
+- tests: capabilityschemadata: Add a real test example (RHEL-222551)
+- util: virFileChownFiles: do not follow symlinks (CVE-2026-63622)
+
 * Fri Jul 24 2026 Jiri Denemark <jdenemar@redhat.com> - 11.10.0-16
 - Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target (RHEL-177646)