VDB

RHSA-2026:53728

RHSA-2026:53728 PUBLISHED CVSS 9.100000381469727 CRITICAL

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Risk Scores

CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red Hatregistry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:da35e3474aefdd42b58d4e9498df8a348162c682804d5d61ac8e50aeaa3b2b98_arm64 as a component of Red Hat Container Native Virtualization 4.21*
Red HatKubeVirt
Red Hatregistry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:adb71cc21725b24648f22d3d458e26ff749cee8d1ce9ecbff3c75f8a30fcd602_s390x as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:a7239dc7dd37fc8fd37d62bcbd8e2181a5d56daae0fd7417287c55b5b82c2ba0_arm64 as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:1446ba7d65f480a5036e528dad8ae7126b604423ea1cb6fb626ceab4d21a644b_arm64 as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:3c9095ca3261e747f5735ba2bd50e19e3c638ed22e01aa6310d993ef13c7c39a_s390x as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:32fb284469021d61a0c9161ad272c7e1a7b7d855f559ceafbc9f2015e5f1b9fa_amd64 as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:f5d6ec45cba17236c5d9b14bb0de46fd3970020bd4d3cc9529017379a7d7b867_s390x as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:f9f4560f8c8b7461ccdffc712ab05ac7accd0222e32cbf322030f7efacdd0752_s390x as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:ecc15205fcb67e4ed55401617cd3a310880c0220fb347891c7f74a764f2968c4_arm64 as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:769969f04a3c4bdd964720db6784a86402305c58d16aea45d11294b388eea32a_s390x as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-synchronization-controller-rhel9@sha256:f720e2dc90a9bff3f7ea5b270462c84466c2feb6830d26d15b41b09755c0f0d8_arm64 as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:1eef40bdfc3b353816016f9c2047313a16f566cd6be51cd613123147981317f0_amd64 as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:9d174f69c1dbb2a5f728e40412adca0cb22c8c807b4a0fc9b6a45acfa9bc1b87_s390x as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:a915d646b8b62d50b00ad020ccc0f108bd0d7ffa25bcd61df28b1afa1c4728df_amd64 as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:fd278c9564c15739424f80677c46983e453922763165cb581e86bc822edcbb1e_s390x as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:98f9b5b0ee258e562a751f27bb68b7edb49e50f9e9febe3297a1892331264ffb_arm64 as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:279df5ddd149cd31ca26dae46e154410ba3394b3e72488de19e1112c9bf84e70_s390x as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:36a8ac5f07d563a8e3fe8ab1499e7e3966c4ae352981dc0e857cbf6a880f579f_arm64 as a component of Red Hat Container Native Virtualization 4.21*
Red Hatregistry.redhat.io/container-native-virtualization/virt-synchronization-controller-rhel9@sha256:c7ba1f288436120dcd436a00a0d5359fc6848895be937ac0c768dd15467b136d_s390x as a component of Red Hat Container Native Virtualization 4.21*

…and 24 more

Timeline

  • Aug 11, 2026 CVE Published
  • Sep 30, 2026 CVE Updated
  • Sep 30, 2026 Distribution Patch
  • Sep 30, 2026 Distribution Patch
  • Sep 30, 2026 Security Advisory
  • Sep 30, 2026 Security Advisory
  • Sep 30, 2026 Security Advisory
  • Sep 30, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›