CVE-2026-63622

Received Received - Intake

Symlink Race Condition in libvirt Leading to Privilege Escalation

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-63622

Affected Vendors & Products

Vendor	Product	Version / Range
libvirt	libvirt	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This is a symlink-following vulnerability in libvirt where a local attacker running as the confined swtpm user can exploit the virFileChownFiles() function. By creating a symbolic link in the swtpm state directory, the attacker tricks the root-level libvirt daemon into changing ownership of an arbitrary file to the swtpm user, enabling privilege escalation from the swtpm sandbox to root-level file control.

Impact Analysis

If exploited, this vulnerability allows an attacker to gain root-level control over files on the system by escalating privileges from a confined swtpm user. This could lead to unauthorized file modifications, data theft, or system compromise depending on the affected files.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data (e.g., personal or health information), potentially leading to data breaches. Organizations may face penalties for failing to protect regulated data under standards like GDPR or HIPAA.

Mitigation Strategies

Update libvirt to the latest patched version to address the symlink-following flaw in virFileChownFiles(). Ensure the swtpm user process is properly confined and lacks unnecessary permissions. Monitor file ownership changes in directories accessible by swtpm.

Hi! I’m here to help you understand CVE-2026-63622. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70