Skip to main content

libvirt CVE-2026-77159

| EUVDEUVD-2026-76034 MEDIUM
UNIX Symbolic Link (Symlink) Following (CWE-61)
2026-09-11 redhat GHSA-wmhq-5pq5-8474
Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Suse Red Hat
5.5
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain swtpm service account access
  2. Delivery
    Remove swtpm logfile, plant symlink to target system file
  3. Exploit
    Trigger libvirtd TPM emulator initialization
  4. Execution
    libvirtd executes root-level chown() on symlink path
  5. Persist
    Target file ownership transferred to swtpm
  6. Impact
    Access or modify sensitive file as swtpm user

Vulnerability Assessment

Weakness
CWE
CWE-61
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling UNIX symlink resolution
Exploitation Conditions

Exploitation requires: (1) local shell access as the swtpm service account - this is a dedicated low-privilege OS user created when swtpm is installed, not a general user account; (2) libvirt must be configured to use software TPM emulation (swtpm) for at least one virtual machine, so that qemuTPMEmulatorPrepareHost() is actually invoked; (3) libvirtd must be running as root (standard deployment on RHEL). Exploitation is NOT possible on systems that do not use virtual TPM emulation, have no swtpm account, or restrict symlink following via kernel hardening (fs.protected_symlinks=1, which is enabled by default on RHEL 6+ and would mitigate this flaw on sticky-bit directories). The CVSS PR:L reflects the swtpm account requirement; general local users without access to that account cannot exploit this.
Impact

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the local, low-privilege attack vector and pure-integrity impact. The score understates the practical danger somewhat: the I:H metric here maps to chown() of arbitrary files, which is a well-understood privilege escalation building block (e.g., chown /etc/shadow to swtpm → read hashes → crack root password). No CISA KEV listing and no known public exploit exist, keeping real-world urgency moderate. The AC:L rating is justified because no race condition is required - the attacker controls the swtpm account and can pre-place the symlink before libvirtd processes it. The attack is constrained to systems where swtpm is actually provisioned and a TPM emulator is configured; systems not using virtual TPM emulation are not exposed. EPSS data is absent from input; based on the local prerequisite and niche attack surface, exploitation probability is likely low.
Exploit ScenarioDerived

An attacker who has obtained shell access as the swtpm service account removes the swtpm logfile and replaces it with a symbolic link pointing to /etc/shadow. When libvirtd next initializes a virtual machine with TPM emulation and calls qemuTPMEmulatorPrepareHost(), it executes chown() on the logfile path as root, transferring ownership of /etc/shadow to the swtpm user. The attacker can then read the shadow file and attempt offline password cracking to escalate to root. No public proof-of-concept is known at time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 11, 2026

Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.

RemediationAI

Upstream fix is under review in GitLab work item #909 (https://gitlab.com/libvirt/libvirt/-/work_items/909); a released patched version has not been independently confirmed from the available data - monitor https://access.redhat.com/security/cve/CVE-2026-77159 for RHEL errata. As a compensating control, restrict access to the swtpm service account to only the swtpm daemon process itself via OS-level account lockout (e.g., set the shell to /sbin/nologin and remove interactive login capability), reducing the attacker's ability to operate as that account. Additionally, deploy filesystem integrity monitoring (e.g., AIDE or auditd rules on the swtpm log directory) to alert on unexpected symlink creation. If virtual TPM emulation is not required, disabling swtpm integration in libvirt eliminates the vulnerable code path entirely with no functional side effect for non-vTPM workloads.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libvirt is a virtualization management API used extensively with QEMU/KVM on Red Hat Enterprise Linux. The qemuTPMEmulatorPrepareHost() function prepares host resources for software TPM emulation via swtpm, a userspace process that runs under a dedicated low-privilege service account. The flaw (CWE-61: UNIX Symbolic Link Following) arises because libvirtd performs a path-based chown() call on the swtpm logfile without first verifying that the path resolves to a regular file rather than a symbolic link. Because libvirtd runs as root, any symlink at that path is followed with full privilege, enabling the owner of the swtpm account to plant a symlink targeting any file on the filesystem prior to the chown() execution. The affected CPEs span cpe:2.3:a:red_hat:red_hat_enterprise_linux_{6,7,8,9,10}.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vuln.today AI 5.5 MEDIUM

Local attack requiring swtpm account (PR:L), no race condition so AC:L, pure integrity impact via arbitrary chown(), no confidentiality or availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

DescriptionCVE.org

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Medium
libvirt common on RHEL virtualization hosts, but swtpm/vTPM usage is not universal
Social Media
1
Sightings
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following

View all
CVE-2026-54420 HIGH POC
8.5
CVE-2026-27976 HIGH POC
8.8
CVE-2024-22014 HIGH POC
8.8
CVE-2025-52565 HIGH POC
8.4
CVE-2026-39860 HIGH POC
8.4
CVE-2026-54574 HIGH POC
8.2
CVE-2026-41326 HIGH POC
8.2
CVE-2025-1079 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Affected
Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-77159 ADVISORY https://ubuntu.com/security/notices/USN-8831-1 ADVISORY https://ubuntu.com/security/notices/USN-8833-1 ADVISORY https://vuldb.com/vuln/402393 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23445/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23460/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23515/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23603/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3939/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4004/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4009/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4010/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4141/ REF https://access.redhat.com/security/cve/CVE-2026-77159 REF https://bugzilla.redhat.com/show_bug.cgi?id=2531811 REF https://gitlab.com/libvirt/libvirt/-/work_items/909

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy