VDB
CVE-2026-77159
CVE-2026-77159
PUBLISHED
CVSS 5.5 MEDIUM
Reported by redhat · Published September 11, 2026
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 6 | |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 6 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Enterprise Linux 8 |
Timeline
- Aug 27, 2026 CVE Published
- Sep 12, 2026 EPSS Score
- Sep 17, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
References
- vdb-entryx_refsource_REDHAT
- RHBZ#2531811 issue-trackingx_refsource_REDHAT