EUVD-2026-54710
GHSA-2gv2-cffp-j227
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local FUSE channel and easy technique give AV:L/AC:L; guest root is required so PR:H; the escape crosses the VM boundary into the host (S:C) yielding full host-root code execution (C:H/I:H/A:H).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
AnalysisAI
Guest-to-host privilege escalation in Kata Containers runtime-rs (main/3.30 line, standalone virtio-fs path) lets an attacker with root inside a Kata guest VM execute arbitrary code as root on the host. Because runtime-rs launches the host virtiofsd daemon as root with '--sandbox none --seccomp none', a raw FUSE_SYMLINK request naming an absolute host path is honored outside the shared directory, breaking VM isolation. Publicly available exploit code exists (detailed PoC in the GHSA advisory that plants a host-root symlink in /etc/cron.d); there is no CISA KEV listing and EPSS is low at 0.07%.
Technical ContextAI
The affected component is the virtio-fs shared-filesystem path in Kata Containers' Rust runtime (runtime-rs), which brokers file sharing between a guest VM and the host using the virtiofsd FUSE daemon and QEMU or Cloud Hypervisor. In the standalone virtio-fs configuration, runtime-rs starts the host-side virtiofsd process as root and, per the pinned source (share_virtio_fs_standalone.rs), passes '--sandbox none --seccomp none', removing the daemon's own namespace/seccomp confinement. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): virtiofsd does not constrain a FUSE_SYMLINK target to the shared directory, so a guest that speaks the FUSE protocol directly to the daemon can request creation of a symlink whose destination is an absolute host path, escaping the intended shared-directory jail and letting guest root write host-root-owned symlinks into arbitrary host locations.
RemediationAI
Vendor-released patch: upgrade Kata Containers to the fixed build 0.0.0-20260519062212-ffa59ce3aa78 (commit ffa59ce3aa7877d067c9a372df0c329a23a01744), per advisory GHSA-2gv2-cffp-j227 (https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227). If you cannot patch immediately, reduce exposure by hardening the virtiofsd invocation so it is no longer run unconfined - run virtiofsd in rootless mode or with sandbox/seccomp enabled (i.e., stop launching it with '--sandbox none --seccomp none'), which restores the namespace and syscall confinement that currently allows the symlink escape, at the cost of some virtio-fs performance and feature compatibility that must be validated for your workloads. Where feasible, switch the shared_fs backend away from the standalone virtio-fs path, restrict Kata to trusted workloads only, and avoid granting root-equivalent capabilities inside guest containers so the PR:H precondition is harder to meet. Verify any workaround against your hypervisor (QEMU/Cloud Hypervisor) before production rollout.
Same weakness CWE-22 – Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today