Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-13201

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Container Native Virtualization 4.12

Default version status: affected

  • 1791522624 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.13

Default version status: affected

  • 1786346596 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.14

Default version status: affected

  • 1786309624 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.15

Default version status: affected

  • 1786347656 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.16

Default version status: affected

  • 1786030071 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.17

Default version status: affected

  • 1786348529 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.18

Default version status: affected

  • 1786130068 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.19

Default version status: affected

  • 1786334215 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.20

Default version status: affected

  • 1785831334 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.21

Default version status: affected

  • 1785829701 to < *unaffected

Red Hat Red Hat Container Native Virtualization 4.22

Default version status: affected

  • 1785140336 to < *unaffected

References