Bug 2513065 (CVE-2026-63622) - CVE-2026-63622 libvirt: swtpm privilege escalation via symlink following
Summary: CVE-2026-63622 libvirt: swtpm privilege escalation via symlink following
Keywords:
Status: NEW
Alias: CVE-2026-63622
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2513834
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-10 09:48 UTC by OSIDB Bzimport
Modified: 2026-10-06 07:37 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:64773 0 None None None 2026-09-08 05:11:26 UTC
Red Hat Product Errata RHSA-2026:65515 0 None None None 2026-09-08 16:13:38 UTC
Red Hat Product Errata RHSA-2026:65516 0 None None None 2026-09-08 15:35:11 UTC
Red Hat Product Errata RHSA-2026:65803 0 None None None 2026-09-09 05:22:04 UTC
Red Hat Product Errata RHSA-2026:68513 0 None None None 2026-09-17 06:11:47 UTC
Red Hat Product Errata RHSA-2026:68594 0 None None None 2026-09-17 11:10:10 UTC
Red Hat Product Errata RHSA-2026:69114 0 None None None 2026-09-21 03:35:55 UTC
Red Hat Product Errata RHSA-2026:69131 0 None None None 2026-09-21 03:57:22 UTC
Red Hat Product Errata RHSA-2026:74424 0 None None None 2026-10-02 02:26:49 UTC
Red Hat Product Errata RHSA-2026:75583 0 None None None 2026-10-05 07:03:40 UTC

Description OSIDB Bzimport 2026-08-10 09:48:58 UTC 
A symlink-following vulnerability was found in libvirt's virFileChownFiles() function in src/util/virfile.c. This function is called from src/qemu/qemu_tpm.c to change ownership of the swtpm state directory when starting a QEMU domain.

The function used stat() (via virFileIsRegular()) and chown(), both of which follow symlinks. A process running as the confined swtpm user (tss) can plant a symlink inside the swtpm state directory pointing to an arbitrary file. When the root-level libvirt daemon starts the next domain, it calls virFileChownFiles() which follows the symlink and chowns the target file to the tss user. This allows escalation from the swtpm sandbox to root-level file ownership control.

The fix replaces stat()/chown() with lstat()/lchown() to avoid following symlinks on the final path component.

Upstream fix: https://gitlab.com/libvirt/libvirt/-/commit/801160fd414ca2cc402bc01ead09b7ed4c3b8f5b
Comment 4 errata-xmlrpc 2026-09-08 05:11:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:64773 https://access.redhat.com/errata/RHSA-2026:64773
Comment 5 errata-xmlrpc 2026-09-08 15:35:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:65516 https://access.redhat.com/errata/RHSA-2026:65516
Comment 6 errata-xmlrpc 2026-09-08 16:13:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:65515 https://access.redhat.com/errata/RHSA-2026:65515
Comment 7 errata-xmlrpc 2026-09-09 05:22:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:65803 https://access.redhat.com/errata/RHSA-2026:65803
Comment 8 Jon Orris 2026-09-17 06:11:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:68513 https://access.redhat.com/errata/RHSA-2026:68513
Comment 9 Jon Orris 2026-09-17 11:10:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:68594 https://access.redhat.com/errata/RHSA-2026:68594
Comment 10 Jon Orris 2026-09-21 03:35:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:69114 https://access.redhat.com/errata/RHSA-2026:69114
Comment 11 Jon Orris 2026-09-21 03:57:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:69131 https://access.redhat.com/errata/RHSA-2026:69131
Comment 12 Jon Orris 2026-10-02 02:26:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:74424 https://access.redhat.com/errata/RHSA-2026:74424
Comment 13 Jon Orris 2026-10-05 07:03:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:75583 https://access.redhat.com/errata/RHSA-2026:75583
Note You need to log in before you can comment on or make changes to this bug.