Bug 2543219 (CVE-2026-102623)
| Summary: | CVE-2026-102623 kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dkeler, suppawar, thason |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
A flaw was found in KubeVirt's virt-controller. A namespace tenant with permission to create VirtualMachineInstance resources can submit a VMI with an empty ephemeral volume specification (ephemeral: {}). The admission webhook validates that the Ephemeral field is non-nil but does not check the inner PersistentVolumeClaim pointer, which defaults to nil as an optional field. When virt-controller processes this VMI, the rendervolumes code dereferences the nil PersistentVolumeClaim pointer, causing a panic. Because the Kubernetes crash handler re-panics by default and the malformed VMI persists in etcd, the controller enters a permanent crash loop, blocking all VM lifecycle operations cluster-wide until an administrator manually deletes the offending VMI.