Description
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Container Native Virtualization 4.12 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.13 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.14 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.15 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.16 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.17 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.18 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.19 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.20 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.21 | — | — |
| Red Hat | Red Hat Container Native Virtualization 4.22 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kubevirt | 1.7.4-150700.3.36.1 | SUSE-SU-2026:3604-1 |
| SLES 15 SP7 | kubevirt-1.6 | 1.6.6-150700.15.17.1 | SUSE-SU-2026:3630-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kubevirt1.8 | 1.8.4-6.1 | openSUSE-SU-2026:12227-1 |
| openSUSE Tumbleweed | kubevirt1.9 | 1.9.0-3.1 | openSUSE-SU-2026:11752-1 |
| openSUSE Leap 16.0 | kubevirt1.8 | 1.8.4-160000.1.1 | openSUSE-SU-2026:21590-1 |
| openSUSE Leap 16.0 | kubevirt1.9 | 1.9.1-160000.1.1 | openSUSE-SU-2026:22180-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubevirt | 1.8.4-4 | — |
| Azure Linux 3 | kubevirt-openvmm | No fix yet | — |
Advisories 6
- openSUSE-SU-2026:22180-1 Security update for kubevirt1.9 SUSE / openSUSE Security Updates · Oct 31, 2026
- openSUSE-SU-2026:12227-1 kubevirt1.8-container-disk-1.8.4-6.1 on GA media SUSE / openSUSE Security Updates · Oct 23, 2026
- openSUSE-SU-2026:11752-1 kubevirt1.9-container-disk-1.9.0-3.1 on GA media SUSE / openSUSE Security Updates · Sep 12, 2026
- openSUSE-SU-2026:21590-1 Security update for kubevirt1.8 SUSE / openSUSE Security Updates · Aug 21, 2026
- SUSE-SU-2026:3630-1 Security update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6 SUSE / openSUSE Security Updates · Aug 18, 2026
- SUSE-SU-2026:3604-1 Security update for kubevirt SUSE / openSUSE Security Updates · Aug 14, 2026
References
- RHEA-2026:53670 vendor-advisory
- RHSA-2026:51031 vendor-advisory
- RHSA-2026:53655 vendor-advisory
- RHSA-2026:53671 vendor-advisory
- RHSA-2026:53684 vendor-advisory
- RHSA-2026:53721 vendor-advisory
- RHSA-2026:53728 vendor-advisory
- RHSA-2026:53763 vendor-advisory
- RHSA-2026:53797 vendor-advisory
- RHSA-2026:53826 vendor-advisory
- RHSA-2026:53838 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-13622 vdb-entry
- RHBZ#2494142 issue-tracking