Skip to content
OpenAdvisories

Description

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support — —
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support — —
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — —
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On — —
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support — —
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On — —
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service — —
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions — —
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions — —
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux for NVIDIA 26 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libvirt 12.6.0-1 —
Debian 13 libvirt 11.3.0-3+deb13u3 —
Debian 12 libvirt No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS libvirt 12.0.0-1ubuntu5.3 USN-8652-1
Ubuntu 26.04 LTS libvirt-hwe 12.0.0-1ubuntu5.5 USN-8833-1
Ubuntu 24.04 LTS libvirt 10.0.0-2ubuntu8.16 USN-8652-1
Ubuntu 22.04 LTS libvirt 8.0.0-1ubuntu7.19 USN-8652-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libvirt 6.0.0-0ubuntu8.20+esm1 USN-8652-1
Ubuntu Pro 18.04 LTS libvirt 4.0.0-1ubuntu8.21+esm1 USN-8652-1
Ubuntu Pro 16.04 LTS libvirt 1.3.1-1ubuntu10.31+esm1 USN-8652-1
Ubuntu Pro 14.04 LTS libvirt 1.2.2-0ubuntu13.1.28+esm2 USN-8652-1
ReleasePackageFixed inAdvisory
RHEL 10 libvirt +31 11.10.0-12.9.el10_2 RHSA-2026:75583
RHEL 9 libvirt +31 11.10.0-12.7.el9_8 RHSA-2026:74424
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS libvirt +31 10.10.0-8.11.el10_0 RHSA-2026:64773
RHEL 9.6 EUS libvirt +31 10.10.0-7.18.el9_6 RHSA-2026:65515
RHEL 9.4 E4S libvirt +27 10.0.0-6.23.el9_4 RHSA-2026:65803
RHEL 9.2 E4S libvirt +21 9.0.0-10.16.el9_2 RHSA-2026:65516
RHEL 8.8 TUS hivex +3 1.3.18-23.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libguestfs +20 1:1.44.0-9.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libguestfs-winsupport 8.8-2.module+el8.8.0+19817+dd5e62f6 RHSA-2026:68513
RHEL 8.8 TUS libiscsi +2 1.18.0-8.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libnbd +4 1.6.0-5.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libtpms +1 0.9.1-3.20211126git1ff6fe1f43.module+el8.8.0+23328+ce46509e RHSA-2026:68513
RHEL 8.8 TUS libvirt +27 8.0.0-19.4.module+el8.8.0+24859+5ac274d4 RHSA-2026:68513
RHEL 8.8 TUS libvirt-dbus 1.3.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS libvirt-python +1 8.0.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS nbdkit +18 1.24.0-5.module+el8.8.0+17308+05924798 RHSA-2026:68513
RHEL 8.8 TUS netcf +2 0.2.8-12.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS perl-Sys-Virt 8.0.0-1.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 TUS qemu-img +9 15:6.2.0-33.module+el8.8.0+23656+9936300e.7 RHSA-2026:68513
RHEL 8.8 E4S SLOF 20210217-2.module+el8.8.0+20737+daad9f3b RHSA-2026:68513
RHEL 8.8 E4S hivex +4 1.3.18-23.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S libguestfs-winsupport 8.8-2.module+el8.8.0+19817+dd5e62f6 RHSA-2026:68513
RHEL 8.8 E4S libiscsi +2 1.18.0-8.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S libnbd +4 1.6.0-5.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S libtpms +1 0.9.1-3.20211126git1ff6fe1f43.module+el8.8.0+23328+ce46509e RHSA-2026:68513
RHEL 8.8 E4S libvirt +27 8.0.0-19.4.module+el8.8.0+24859+5ac274d4 RHSA-2026:68513
RHEL 8.8 E4S libvirt-dbus 1.3.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S libvirt-python +1 8.0.0-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S nbdkit +18 1.24.0-5.module+el8.8.0+17308+05924798 RHSA-2026:68513
RHEL 8.8 E4S netcf +2 0.2.8-12.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S perl-Sys-Virt 8.0.0-1.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S qemu-img +13 15:6.2.0-33.module+el8.8.0+23656+9936300e.7 RHSA-2026:68513
RHEL 8.8 E4S seabios +2 1.16.0-4.module+el8.8.0+19627+2d14cb21 RHSA-2026:68513
RHEL 8.8 E4S sgabios +1 1:0.20170427git-3.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S supermin +1 5.2.1-2.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S swtpm +4 0.7.0-4.20211109gitb79fd91.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S virt-dib +22 1:1.44.0-9.module+el8.8.0+16781+9f4724c2 RHSA-2026:68513
RHEL 8.8 E4S virt-v2v +3 1:1.42.0-22.module+el8.8.0+19067+b66cdac6 RHSA-2026:68513
RHEL 8.6 EUS Long Life SLOF 20210217-1.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life hivex +3 1.3.18-23.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libguestfs +20 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libguestfs-winsupport 8.6-2.module+el8.6.0+19818+47334628 RHSA-2026:68594
RHEL 8.6 EUS Long Life libiscsi +2 1.18.0-8.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libnbd +4 1.6.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libtpms +1 0.9.1-2.20211126git1ff6fe1f43.module+el8.6.0+23331+44040c55 RHSA-2026:68594
RHEL 8.6 EUS Long Life libvirt +27 8.0.0-5.12.module+el8.6.0+24861+997f960b RHSA-2026:68594
RHEL 8.6 EUS Long Life libvirt-dbus 1.3.0-2.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life libvirt-python +1 8.0.0-1.1.module+el8.6.0+16381+3abc475c RHSA-2026:68594
RHEL 8.6 EUS Long Life nbdkit +18 1.24.0-4.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life netcf +2 0.2.8-12.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life perl-Sys-Virt 8.0.0-1.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 EUS Long Life qemu-img +9 15:6.2.0-11.module+el8.6.0+23680+701901c8.17 RHSA-2026:68594
RHEL 8.6 AUS hivex +4 1.3.18-23.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS libguestfs-winsupport 8.6-2.module+el8.6.0+19818+47334628 RHSA-2026:68594
RHEL 8.6 AUS libiscsi +2 1.18.0-8.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS libnbd +4 1.6.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS libtpms +1 0.9.1-2.20211126git1ff6fe1f43.module+el8.6.0+23331+44040c55 RHSA-2026:68594
RHEL 8.6 AUS libvirt +27 8.0.0-5.12.module+el8.6.0+24861+997f960b RHSA-2026:68594
RHEL 8.6 AUS libvirt-dbus 1.3.0-2.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS libvirt-python +1 8.0.0-1.1.module+el8.6.0+16381+3abc475c RHSA-2026:68594
RHEL 8.6 AUS nbdkit +18 1.24.0-4.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS netcf +2 0.2.8-12.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS perl-Sys-Virt 8.0.0-1.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS qemu-img +13 15:6.2.0-11.module+el8.6.0+23680+701901c8.17 RHSA-2026:68594
RHEL 8.6 AUS seabios +2 1.15.0-2.module+el8.6.0+19580+39804e41.1 RHSA-2026:68594
RHEL 8.6 AUS sgabios +1 1:0.20170427git-3.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS supermin +1 5.2.1-1.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS swtpm +4 0.7.0-3.20211109gitb79fd91.module+el8.6.0+16156+d5629340 RHSA-2026:68594
RHEL 8.6 AUS virt-dib +22 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2026:68594
RHEL 8.6 AUS virt-v2v +3 1:1.42.0-19.module+el8.6.0+15577+2ffd6ffa RHSA-2026:68594
RHEL 8.4 EUS Long Life SLOF 20191022-3.git899d9883.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 EUS Long Life hivex +4 1.3.18-21.module+el8.4.0+10770+19c037f9 RHSA-2026:69131
RHEL 8.4 EUS Long Life libguestfs-winsupport 8.4-1.module+el8.4.0+19830+486a2a6d RHSA-2026:69131
RHEL 8.4 EUS Long Life libiscsi +2 1.18.0-8.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 EUS Long Life libnbd +3 1.2.2-1.module+el8.3.0+7353+9de0a3cc RHSA-2026:69131
RHEL 8.4 EUS Long Life libvirt +28 6.0.0-35.6.module+el8.4.0+24887+5ada1549 RHSA-2026:69131
RHEL 8.4 EUS Long Life libvirt-dbus 1.3.0-2.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 EUS Long Life nbdkit +13 1.16.2-4.module+el8.3.0+6922+fd575af8 RHSA-2026:69131
RHEL 8.4 EUS Long Life netcf +2 0.2.8-12.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 EUS Long Life perl-Sys-Virt +2 6.0.0-1.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 EUS Long Life qemu-img +9 15:4.2.0-49.module+el8.4.0+23681+5ef782f9.12 RHSA-2026:69131
RHEL 8.4 EUS Long Life seabios +2 1.13.0-2.module+el8.3.0+7353+9de0a3cc RHSA-2026:69131
RHEL 8.4 EUS Long Life sgabios +1 1:0.20170427git-3.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 EUS Long Life supermin +1 5.1.19-10.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 EUS Long Life virt-dib +23 1:1.40.2-27.module+el8.4.0+9282+0bdec052 RHSA-2026:69131
RHEL 8.4 AUS hivex +4 1.3.18-21.module+el8.4.0+10770+19c037f9 RHSA-2026:69131
RHEL 8.4 AUS libguestfs-winsupport 8.4-1.module+el8.4.0+19830+486a2a6d RHSA-2026:69131
RHEL 8.4 AUS libiscsi +2 1.18.0-8.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 AUS libnbd +3 1.2.2-1.module+el8.3.0+7353+9de0a3cc RHSA-2026:69131
RHEL 8.4 AUS libvirt +28 6.0.0-35.6.module+el8.4.0+24887+5ada1549 RHSA-2026:69131
RHEL 8.4 AUS libvirt-dbus 1.3.0-2.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 AUS nbdkit +13 1.16.2-4.module+el8.3.0+6922+fd575af8 RHSA-2026:69131
RHEL 8.4 AUS netcf +2 0.2.8-12.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 AUS perl-Sys-Virt +2 6.0.0-1.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 AUS qemu-img +9 15:4.2.0-49.module+el8.4.0+23681+5ef782f9.12 RHSA-2026:69131
RHEL 8.4 AUS seabios +2 1.13.0-2.module+el8.3.0+7353+9de0a3cc RHSA-2026:69131
RHEL 8.4 AUS sgabios +1 1:0.20170427git-3.module+el8.1.0+4066+0f1aadab RHSA-2026:69131
RHEL 8.4 AUS supermin +1 5.1.19-10.module+el8.3.0+6423+e4cb6418 RHSA-2026:69131
RHEL 8.4 AUS virt-dib +23 1:1.40.2-27.module+el8.4.0+9282+0bdec052 RHSA-2026:69131
RHEL 7 ELS libvirt +30 4.5.0-36.el7_9.7 RHSA-2026:69114

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 libvirt +31 11.10.0-12.9.el10_2.alma.1 ALSA-2026:75583
AlmaLinux 9 libvirt +31 11.10.0-12.7.el9_8.alma.1 ALSA-2026:74424

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 libvirt 11.10.0-12.9.el10_2 RLSA-2026:75583
Rocky Linux 9 libvirt 11.10.0-12.7.el9_8 RLSA-2026:74424
ReleasePackageFixed inAdvisory
SLES 15 SP7 libvirt 11.0.0-150700.4.27.1 SUSE-SU-2026:3939-1
SLES 15 SP6 libvirt 10.0.0-150600.8.18.1 SUSE-SU-2026:4010-1
SLES 15 SP5 libvirt 9.0.0-150500.6.29.1 SUSE-SU-2026:4009-1
SLES 15 SP4 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
SLES 12 SP5 libvirt 5.1.0-13.48.1 SUSE-SU-2026:4141-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 libvirt 11.4.0-160000.5.1 SUSE-SU-2026:23603-1
SLES for SAP 15 SP6 libvirt 10.0.0-150600.8.18.1 SUSE-SU-2026:4010-1
SLES for SAP 15 SP5 libvirt 9.0.0-150500.6.29.1 SUSE-SU-2026:4009-1
SLES for SAP 15 SP4 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
SLES 16.0 libvirt 11.4.0-160000.5.1 SUSE-SU-2026:23603-1
SLE Micro 6.2 libvirt 11.4.0-160000.5.1 SUSE-SU-2026:23460-1
SLE Micro 6.1 libvirt 10.0.0-slfo.1.1_3.1 SUSE-SU-2026:23515-1
SLE Micro 6.0 libvirt 10.0.0-5.1 SUSE-SU-2026:23445-1
SLE Micro 5.5 libvirt 9.0.0-150500.6.29.1 SUSE-SU-2026:4009-1
SLE Micro 5.4 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
SLE Micro 5.3 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
SLE HPC 15 SP5 libvirt 9.0.0-150500.6.29.1 SUSE-SU-2026:4009-1
SLE HPC 15 SP4 libvirt 8.0.0-150400.7.17.1 SUSE-SU-2026:4004-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 libvirt 11.4.0-160000.5.1 openSUSE-SU-2026:21738-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 libvirt +30 4.5.0-36.amzn2.3.3 ALAS2-2026-3873

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libvirt 11.9.0-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 libvirt +31 11.10.0-12.9.0.1.el10_2 ELSA-2026-75583
Oracle Linux 9 libvirt +31 11.10.0-12.7.0.1.el9_8 ELSA-2026-74424

Advisories 30

References