A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Sep 21, 2026 | Aug 10, 2026 |
| Redhat_linux | — | Upgrade libvirt-daemon-plugin-sanlock-debuginfoUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-plugin-sanlockUpgrade libvirt-libsUpgrade libvirt-ssh-proxy-debuginfoUpgrade libvirt-client-qemuUpgrade libvirt-debuginfoUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-qemu-debuginfoUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-ssh-proxyUpgrade libvirt-nss-debuginfoUpgrade libvirt-nssUpgrade libvirt-daemon-common-debuginfoUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-rbd-debuginfoUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-logical-debuginfoUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storage-core-debuginfoUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemonUpgrade libvirt-daemon-proxy-debuginfoUpgrade libvirt-lock-sanlock-debuginfoUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-nwfilter-debuginfoUpgrade libvirt-daemon-logUpgrade libvirt-daemon-lock-debuginfoUpgrade libvirt-daemon-driver-secret-debuginfoUpgrade libvirt-daemon-log-debuginfoUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-network-debuginfoUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-wireshark-debuginfoUpgrade libvirtUpgrade libvirt-daemon-driver-nodedev-debuginfoUpgrade libvirt-libs-debuginfoUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-scsi-debuginfoUpgrade libvirt-daemon-plugin-lockdUpgrade libvirt-daemon-proxyUpgrade libvirt-client-debuginfoUpgrade libvirt-debugsourceUpgrade libvirt-daemon-driver-interface-debuginfoUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-clientUpgrade libvirt-bash-completionUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-mpath-debuginfoUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-storage-iscsi-debuginfoUpgrade libvirt-daemon-debuginfoUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-disk-debuginfoUpgrade libvirt-daemon-plugin-lockd-debuginfoUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-nodedevNo solution existsUpgrade libvirt-daemon-commonUpgrade libvirt-daemon-lock | Aug 12, 2026 | Jul 30, 2026 |
| Rocky_linux | — | Upgrade libvirt-daemon-plugin-lockdUpgrade libvirt-nssUpgrade libvirt-debuginfoUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-proxyUpgrade libvirt-ssh-proxy-debuginfoUpgrade libvirt-daemon-driver-network-debuginfoUpgrade libvirt-daemon-driver-nodedev-debuginfoUpgrade libvirt-client-debuginfoUpgrade libvirt-daemon-driver-storage-mpath-debuginfoUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-iscsi-debuginfoUpgrade libvirt-daemon-driver-interface-debuginfoUpgrade libvirt-libs-debuginfoUpgrade libvirt-daemon-driver-storage-disk-debuginfoUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-lockUpgrade libvirt-daemon-debuginfoUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storageUpgrade libvirt-clientUpgrade libvirt-daemon-plugin-sanlockUpgrade libvirt-daemon-lock-debuginfoUpgrade libvirt-daemon-plugin-sanlock-debuginfoUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-storage-scsi-debuginfoUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-debugsourceUpgrade libvirt-nss-debuginfoUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-qemu-debuginfoUpgrade libvirt-daemon-plugin-lockd-debuginfoUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-develUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-libsUpgrade libvirtUpgrade libvirt-daemon-commonUpgrade libvirt-daemon-driver-storage-core-debuginfoUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-client-qemuUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-nwfilter-debuginfoUpgrade libvirt-daemon-logUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-rbd-debuginfoUpgrade libvirt-daemon-log-debuginfoUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-common-debuginfoUpgrade libvirt-ssh-proxyUpgrade libvirt-daemon-driver-storage-logical-debuginfoUpgrade libvirt-daemon-proxy-debuginfoUpgrade libvirt-daemon-driver-secret-debuginfoUpgrade libvirt-daemon | Oct 5, 2026 | Oct 3, 2026 |
| Ubuntu | — | Upgrade libvirt-daemon-driver-secretUpgrade libvirt-devUpgrade libvirt-daemon-systemUpgrade libnss-libvirt (Ubuntu Pro)Upgrade libvirt-daemon-hweUpgrade libvirt-daemon-system-systemd (Ubuntu Pro)Upgrade libvirt-daemon-system-systemdUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-sanlockUpgrade libvirt-clients (Ubuntu Pro)Upgrade libvirt-daemon-system-sysv (Ubuntu Pro)Upgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemonUpgrade libvirt-daemon-system-hweUpgrade libvirt-wireshark (Ubuntu Pro)Upgrade libvirt-daemon-commonUpgrade libvirt-wiresharkUpgrade libvirt-daemon-logUpgrade libvirt-daemon-driver-qemu (Ubuntu Pro)Upgrade libvirt-login-shellUpgrade libvirt-dev (Ubuntu Pro)Upgrade libvirt-clients-qemuUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-bin (Ubuntu Pro)Upgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-config-networkUpgrade libvirt0-hweUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-vbox (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-rbd (Ubuntu Pro)Upgrade libvirt-daemon-lockUpgrade libvirt-daemon-driver-storage-zfs (Ubuntu Pro)Upgrade libnss-libvirtUpgrade libvirt-daemon-plugin-lockdUpgrade libvirt-daemon-driver-vboxUpgrade libvirt-daemon-plugin-sanlockUpgrade libvirt-daemon-driver-xen (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-sanlock (Ubuntu Pro)Upgrade libvirt-daemon-system (Ubuntu Pro)Upgrade libvirt-daemon-driver-xenUpgrade libvirt0 (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-gluster (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-clientsUpgrade libvirt-daemon-driver-lxc (Ubuntu Pro)Upgrade libvirt-daemon-driver-interfaceUpgrade libvirt-ssh-proxyUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon (Ubuntu Pro)Upgrade libvirt-daemon-system-sysvUpgrade libvirt-daemon-driver-storage-zfsUpgrade libvirt-commonUpgrade libvirt0Upgrade libvirt-daemon-driver-storage-sheepdog (Ubuntu Pro) | Aug 20, 2026 | Aug 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub