VDB

RHSA-2026:53763

RHSA-2026:53763 PUBLISHED CVSS 9.100000381469727 CRITICAL

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Risk Scores

CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red Hatregistry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:b6a04f11b483e56ff274c06b1e37dc21857b5f4f4894ae1fbdbd911e4e8044ee_arm64 as a component of Red Hat Container Native Virtualization 4.2*
Red Hatregistry.redhat.io/container-native-virtualization/virt-synchronization-controller-rhel9@sha256:925f744df66b75b27e583ef73b516dbc2fadbe94b9923e4676d2ae91221d7af7_amd64 as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:2484a6c137f63d51400a9eae1280d0732c6ff138f38b767e6630769a1a663752_arm64 as a component of Red Hat Container Native Virtualization 4.2*
Red Hatregistry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:1709a7d2d244242522129bbde3df1747f9bdbdf3864326ee8b433bbfc3739609_amd64 as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:ca8bdcb57fbd508abd84a8f90ddf8814ba90c48260ab0487912cd73446e860b9_amd64 as a component of Red Hat Container Native Virtualization 4.2*
Red Hatregistry.redhat.io/container-native-virtualization/virt-exportserver-rhel9@sha256:b6a04f11b483e56ff274c06b1e37dc21857b5f4f4894ae1fbdbd911e4e8044ee_arm64 as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:eed15c476ec896f6a78cd588c789c6ba2c7cadf924610fe56a147645beb0bf25_amd64 as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/virt-exportproxy-rhel9@sha256:18681858e47d4d2d169bf21bfacd943f0029a60bdf423664d5dd62a4514a88ea_arm64 as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:3c4564a91c58287af63e4640db353e42c843c3a12c0ff13321fee26046d8965e_amd64 as a component of Red Hat Container Native Virtualization 4.2*
Red Hatregistry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:8a18299a120af78a290db514378a79d0c92b98ab2f85c1b9c57380dae521445f_s390x as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/virt-launcher-rhel9@sha256:75c3c9838700a4f6375d15a6661eb8ab93ed19987be7b60a2d40542b0b94d2c9_s390x as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/virt-operator-rhel9@sha256:c48048fa552109936e097e309eb6fea6fac7919aafdc55dc8f99cf7a0ff5dea1_arm64 as a component of Red Hat Container Native Virtualization 4.2*
Red Hatregistry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:eaf455f757f4ae47efa9aab416cc49dfdf5bd6b380672c957554617dfcf8c263_arm64 as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:22813de64d0e84013b5f2a1b1699888f952f317913a4d755e2e9e76ca61d809d_s390x as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:e3ecb267c56c3cf6b1aeee43b675844546fd2dd3bbbec2d480ceca0044fd1d28_arm64 as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:5b32246480ab2732aad524a1353857f6254a6693712f325d12b6e4f61244ad28_arm64 as a component of Red Hat Container Native Virtualization 4.2*
Red Hatregistry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:ca8bdcb57fbd508abd84a8f90ddf8814ba90c48260ab0487912cd73446e860b9_amd64 as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/virt-handler-rhel9@sha256:74d84856f22700bb735e97b2d721080f66908c29264ded38a2c3b5cd502fce70_amd64 as a component of Red Hat Container Native Virtualization 4.2*
Red Hatregistry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:5885a1074a3a65b4738e645330e859b598633099d07c752de587742c4910972c_s390x as a component of Red Hat Container Native Virtualization 4.20*
Red Hatregistry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:8a18299a120af78a290db514378a79d0c92b98ab2f85c1b9c57380dae521445f_s390x as a component of Red Hat Container Native Virtualization 4.2*

…and 66 more

Timeline

  • Aug 11, 2026 CVE Published
  • Sep 30, 2026 CVE Updated
  • Sep 30, 2026 Distribution Patch
  • Sep 30, 2026 Distribution Patch
  • Sep 30, 2026 Security Advisory
  • Sep 30, 2026 Security Advisory
  • Sep 30, 2026 Security Advisory
  • Sep 30, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›