The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade qemu-kvm-device-display-virtio-vgaUpgrade qemu-kvmUpgrade qemu-kvm-ui-openglUpgrade qemu-kvm-block-blkioUpgrade qemu-kvm-coreUpgrade qemu-kvm-toolsUpgrade qemu-kvm-device-usb-hostUpgrade qemu-kvm-device-usb-redirectUpgrade qemu-kvm-docsUpgrade qemu-imgUpgrade qemu-kvm-ui-egl-headlessUpgrade qemu-kvm-commonUpgrade qemu-kvm-audio-paUpgrade qemu-pr-helperUpgrade qemu-kvm-block-curlUpgrade qemu-guest-agentUpgrade qemu-kvm-block-rbdUpgrade qemu-kvm-device-display-virtio-gpu-pciUpgrade qemu-kvm-device-display-virtio-gpu | Nov 4, 2026 | Jul 20, 2026 |
| Redhat_linux | — | Upgrade qemu-kvm-device-display-virtio-vgaUpgrade qemu-kvm-ui-openglUpgrade qemu-kvm-device-display-virtio-gpu-pci-debuginfoUpgrade qemu-kvm-coreUpgrade qemu-kvm-tools-debuginfoUpgrade qemu-kvm-ui-dbus-debuginfoUpgrade qemu-kvm-device-usb-hostUpgrade qemu-kvm-block-blkio-debuginfoUpgrade qemu-kvm-device-usb-redirectUpgrade qemu-kvm-debugsourceUpgrade qemu-kvm-device-usb-redirect-debuginfoUpgrade qemu-kvm-block-rbd-debuginfoUpgrade qemu-kvm-docsUpgrade qemu-imgUpgrade qemu-kvm-block-blkioUpgrade qemu-kvm-toolsUpgrade qemu-kvm-audio-pa-debuginfoUpgrade qemu-kvm-commonUpgrade qemu-kvm-device-display-virtio-gpu-pciUpgrade qemu-kvm-core-debuginfoUpgrade qemu-guest-agentUpgrade qemu-kvm-device-display-virtio-gpu-ccw-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-debuginfoUpgrade qemu-pr-helperUpgrade qemu-kvm-device-usb-host-debuginfoUpgrade qemu-kvm-block-curlUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-ccwUpgrade qemu-kvm-device-display-virtio-gpuUpgrade qemu-guest-agent-debuginfoUpgrade qemu-img-debuginfoUpgrade qemu-kvm-tests-debuginfoUpgrade qemu-pr-helper-debuginfoUpgrade qemu-kvm-ui-egl-headlessUpgrade qemu-kvmNo solution existsUpgrade qemu-kvm-audio-dbus-debuginfoUpgrade qemu-kvm-common-debuginfoUpgrade qemu-kvm-audio-paUpgrade qemu-kvm-block-curl-debuginfoUpgrade qemu-kvm-device-display-virtio-vga-debuginfoUpgrade qemu-kvm-block-rbdUpgrade qemu-kvm-ui-egl-headless-debuginfoUpgrade qemu-kvm-ui-opengl-debuginfo | Jul 22, 2026 | Jul 9, 2026 |
| Rocky_linux | — | Upgrade qemu-kvm-block-blkio-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-debuginfoUpgrade qemu-kvm-audio-pa-debuginfoUpgrade qemu-kvm-device-display-virtio-gpuUpgrade qemu-guest-agentUpgrade qemu-kvm-block-rbd-debuginfoUpgrade qemu-kvm-device-display-virtio-vga-debuginfoUpgrade qemu-img-debuginfoUpgrade qemu-pr-helper-debuginfoUpgrade qemu-kvm-block-curl-debuginfoUpgrade qemu-kvm-commonUpgrade qemu-kvm-docsUpgrade qemu-kvm-device-display-virtio-gpu-pci-debuginfoUpgrade qemu-kvmUpgrade qemu-kvm-block-blkioUpgrade qemu-kvm-block-curlUpgrade qemu-kvm-common-debuginfoUpgrade qemu-kvm-audio-paUpgrade qemu-kvm-toolsUpgrade qemu-kvm-device-display-virtio-gpu-ccw-debuginfoUpgrade qemu-kvm-tools-debuginfoUpgrade qemu-guest-agent-debuginfoUpgrade qemu-kvm-device-usb-hostUpgrade qemu-kvm-ui-egl-headlessUpgrade qemu-kvm-debugsourceUpgrade qemu-kvm-ui-openglUpgrade qemu-imgUpgrade qemu-kvm-device-usb-redirectUpgrade qemu-kvm-ui-egl-headless-debuginfoUpgrade qemu-kvm-coreUpgrade qemu-kvm-device-usb-host-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-pciUpgrade qemu-kvm-device-usb-redirect-debuginfoUpgrade qemu-kvm-device-display-virtio-vgaUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-block-rbdUpgrade qemu-pr-helperUpgrade qemu-kvm-core-debuginfoUpgrade qemu-kvm-ui-opengl-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-ccw | Oct 26, 2026 | Oct 23, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub