CVE-2026-61477: Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

A flaw was found in libvirt. The network XML parser accepts XML numeric character references for line breaks ( / ) in DNS TXT record value attributes and SRV record domain/target attributes without sanitization. The network driver writes these values directly into the line-oriented dnsmasq configuration file as txt-record= or srv-host= directives. An embedded newline terminates the intended directive and begins a new one under attacker control (e.g., dhcp-script=/bin/sh -c '<cmd>'), which dnsmasq executes as root when the virtual network is started. Under the default libvirt deployment model, read-write access to the libvirt socket is already root-equivalent, and the <dnsmasq:options> raw namespace already provides a documented mechanism for arbitrary directive injection, making this a hardening issue only. However, under non-default polkit fine-grained access control configurations that grant only network.write and network.start permissions, this could represent a privilege boundary violation.