Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-102623 EUVD-2026-89100GHSA-x9f5-3f6m-x9jh

Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume

Published Sep 29, 2026 · Updated Sep 29, 2026 · Assigned by redhat

Description

A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat OpenShift Virtualization 4 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kubevirt +1 No fix yet —

References