CVE-2026-102623
Received Received - Intake

KubeVirt Ephemeral Volume DoS via Empty Volume

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: redhat-SADP

Description
A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102623
EUVD
EUVD-2026-89100

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat kubevirt *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service (DoS) vulnerability in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can submit a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to validate this configuration properly, causing an unhandled exception and application crash during processing. The malformed definition persists in the cluster, leading the controller into a continuous crash loop that disrupts virtual machine lifecycle operations across the environment.

Detection Guidance

Check KubeVirt controller logs for repeated crashes or unhandled exceptions during VMI processing. Look for empty ephemeral volume definitions in VMIs. Monitor cluster events for virt-controller failures or persistent crash loops.

Impact Analysis

If you use KubeVirt in your environment, an attacker with valid credentials could exploit this flaw to crash the virt-controller. This would disrupt the creation, management, and operation of virtual machines, potentially causing downtime for services relying on these VMs. The continuous crash loop may require manual intervention to restore normal operations.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that lead to data processing delays or unavailability. For GDPR, this may affect the right to timely access or rectification of data. For HIPAA, it could disrupt critical healthcare services or data access. Organizations must address this flaw to maintain service availability and compliance with availability-related requirements.

Mitigation Strategies

Update KubeVirt to the latest patched version. Review and remove any VMIs with empty ephemeral volumes. Implement validation checks to prevent malformed VMI definitions from being created.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart