CVE-2026-63622: Libvirt: swtpm privilege escalation via symlink following
A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.
Other sources
A symlink-following vulnerability was found in libvirt's virFileChownFiles() function in src/util/virfile.c. This function is called from src/qemu/qemutpm.c to change ownership of the swtpm state directory when starting a QEMU domain.
The function used stat() (via virFileIsRegular()) and chown(), both of which follow symlinks. A process running as the confined swtpm user (tss) can plant a symlink inside the swtpm state directory pointing to an arbitrary file. When the root-level libvirt daemon starts the next domain, it calls virFileChownFiles() which follows the symlink and chowns the target file to the tss user. This allows escalation from the swtpm sandbox to root-level file ownership control.
The fix replaces stat()/chown() with lstat()/lchown() to avoid following symlinks on the final path component.
Upstream fix: https://gitlab.com/libvirt/libvirt/-/commit/801160fd414ca2cc402bc01ead09b7ed4c3b8f5b
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libvirtto a version that resolves this vulnerability.Patch 801160fd414ca2cc402bc01ead09b7ed4c3b8f5b - Configuration
Update/patch libvirt so virFileChownFiles() replaces stat()/chown() with lstat()/lchown() to avoid following symlinks on the final path component (the upstream fix described for src/util/virfile.c).
libvirt (virFileChownFiles / src/util/virfile.c) Symlink handling in ownership change = Use lstat()/lchown() instead of stat()/chown() for the final path component - Compensating control
Prevent confined swtpm (tss) from planting symlinks in the swtpm state directory that is used by libvirt (src/qemu/qemu_tpm.c) to chown the swtpm state directory at QEMU domain startup.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63622?
The severity of CVE-2026-63622 is high with a CVSS score of 7.8.
What vulnerability is described in CVE-2026-63622?
CVE-2026-63622 describes a symlink-following privilege escalation vulnerability in the `virFileChownFiles()` function within libvirt.
Who can exploit CVE-2026-63622?
A local attacker, specifically a process running as the confined `swtpm` user, can exploit CVE-2026-63622.
How does CVE-2026-63622 allow for privilege escalation?
CVE-2026-63622 allows privilege escalation by tricking the system into following a malicious symbolic link planted in the `swtpm` state directory.
What software is affected by CVE-2026-63622?
CVE-2026-63622 affects the libvirt software.