Description
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5.0 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux for NVIDIA 26 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:11.1.2+ds-1 | — |
| Debian 13 | qemu | No fix yet | — |
| Debian 12 | qemu | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qemu +1 | No fix yet | — |
| Ubuntu 26.04 LTS | qemu +1 | No fix yet | — |
| Ubuntu 24.04 LTS | qemu | No fix yet | — |
| Ubuntu 22.04 LTS | qemu | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | qemu | No fix yet | — |
| Ubuntu Pro 18.04 LTS | qemu | No fix yet | — |
| Ubuntu Pro 16.04 LTS | qemu | No fix yet | — |
| Ubuntu Pro 14.04 LTS | qemu | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | qemu-img +19 | 17:10.1.0-17.el9_8.9 | RHSA-2026:88421 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | qemu-img +19 | 17:10.1.0-17.el9_8.9.alma.1 | ALSA-2026:88421 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | qemu-kvm | 7:10.1.0-17.el9_8.9 | RLSA-2026:88421 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | qemu | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | qemu-img +18 | 17:10.1.0-17.el9_8.9 | ELSA-2026-88421 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
M8seven/cve-2026-12080-qemu-guest-agent-authorized-keys ★ 0 · Oct 22, 2026
Technical writeup of CVE-2026-12080: local privilege escalation in the QEMU Guest Agent (qga) guest-ssh-add-authorized-keys handler via symlink following.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2026:88421 Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2295 QEMU: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Nov 9, 2026
- ALSA-2026:88421 Important: qemu-kvm security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 4, 2026
- ELSA-2026-88421 Important: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 3, 2026
- RLSA-2026:88421 Important: qemu-kvm security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 23, 2026
References
- RHSA-2026:88421 vendor-advisory
- RHSA-2026:94537 vendor-advisory
- RHSA-2026:95346 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-12080 vdb-entry
- RHBZ#2499603 issue-tracking
- https://gitlab.com/qemu-project/qemu/-/work_items/3929