{"id":"CVE-2026-13201","revision":"9e24dd07253c41098c4f32300ab75815","records":[{"revision":"9e24dd07253c41098c4f32300ab75815","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-13201","aliases":[],"title":"Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption","description":"A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.","state":0,"publishedAt":"2026-06-24T20:39:00.173+00:00","modifiedAt":"2026-10-12T20:47:23.283+00:00","affected":[{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.12\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1791522624\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.12::el8\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.13\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1786346596\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.13::el9\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.14\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1786309624\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.14::el9\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.15\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1786347656\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.15::el9\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.16\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1786030071\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.16::el9\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.17\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1786348529\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.17::el9\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.18\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1786130068\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.18::el9\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.19\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1786334215\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.19::el9\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.20\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1785831334\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.20::el9\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.21\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1785829701\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.21::el9\"\n ]\n }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"container-native-virtualization/virt-handler-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Red Hat\",\n \"product\": \"Red Hat Container Native Virtualization 4.22\",\n \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n \"packageName\": \"container-native-virtualization/virt-handler-rhel9\",\n \"defaultStatus\": \"affected\",\n \"versions\": [\n {\n \"version\": \"1785140336\",\n \"lessThan\": \"*\",\n \"versionType\": \"rpm\",\n \"status\": \"unaffected\"\n }\n ],\n \"cpes\": [\n \"cpe:/a:redhat:container_native_virtualization:4.22::el9\"\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","score":7.3,"severity":"HIGH"}],"references":["https://access.redhat.com/errata/RHSA-2026:51031","https://access.redhat.com/errata/RHSA-2026:53655","https://access.redhat.com/errata/RHSA-2026:53671","https://access.redhat.com/errata/RHSA-2026:53684","https://access.redhat.com/errata/RHSA-2026:53721","https://access.redhat.com/errata/RHSA-2026:53728","https://access.redhat.com/errata/RHSA-2026:53763","https://access.redhat.com/errata/RHSA-2026:53797","https://access.redhat.com/errata/RHSA-2026:53826","https://access.redhat.com/errata/RHSA-2026:53838","https://access.redhat.com/errata/RHSA-2026:80941","https://access.redhat.com/security/cve/CVE-2026-13201","https://bugzilla.redhat.com/show_bug.cgi?id=2492203"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-13201","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-13201","identifiers":["CVE-2026-13201"]},"retained":false,"historicalAffected":[]}],"coverage":[]}