Local privilege escalation via RPC integer overflow

Integer overflow in libvirt in Red Hat Enterprise Linux allows local users to corrupt libvirtd memory via crafted NodeGetFreePages RPC arguments. The remoteDispatchNodeGetFreePages handler multiplies pages_len by cellCount as unsigned integers for both the REMOTE_NODE_MAX_CELLS limit check and result-buffer sizing, so wraparound can pass the check and allocate too little heap memory before the hypervisor driver writes NUMA page data. Reachability requires local access to libvirt's read-only Unix socket, and successful overwrite can crash the root daemon or provide a path to local privilege escalation.