OpenStack Nova: crafted QCOW header on a Flat-backend disk lets a tenant destroy host data on resize

Impact

A tenant who can write to their own root or ephemeral disk can plant a malicious QCOW header and then request a resize. Nova's Flat image backend invokes qemu-img without pinning the input format, so qemu-img honours the attacker's header instead of treating the disk as raw, and the resize can write outside the instance's own file and destroy data on the compute host. On a GPU compute node that means damage to host filesystem state shared by every other instance on the box, including co-tenant disks - integrity and availability loss with no confidentiality gain. Only compute nodes running the Flat image backend, normally use_cow_images=False, are affected; qcow2 and Ceph-backed nodes are not.

Who can reach it

Any authenticated tenant with an instance on an affected compute node - they need only the ability to write to their own disk and call the resize API. No host access and no admin role required, but the node must be using the Flat image backend.

What to do

Upgrade Nova to 30.2.2, 31.2.1 or 32.1.1 (or the vendor build: RHSA-2026:54757, RHSA-2026:66401) and restart the nova-compute service on every affected node; a rolling restart is enough, instances keep running. If you cannot patch immediately, the exposure is confined to nodes with use_cow_images=False, so switching those nodes to the qcow2 or Ceph backend, or blocking resize on them, removes the path. The advisory names fixed versions only; no host reboot is indicated.

References

Related entries

• Linux kernel xen/privcmd: unrestricted hypercalls from an unprivileged domU break secure boot (XSA-482)CVE-2026-31788 · Linux kernel Xen privcmd driver (unprivileged domU hypercall scope)High
• AsyncSSH: username path traversal in AuthorizedKeysFile %u lets an attacker pick the key fileCVE-2026-45309 · AsyncSSH server (AuthorizedKeysFile %u token expansion)High
• Linux kernel pKVM on arm64: host-supplied __hyp_running_vcpu pointer dereferenced at EL2CVE-2026-64286 · Linux kernel KVM arm64 pKVM (flush_hyp_vcpu context copy, __hyp_running_vcpu)High
• Linux kernel pKVM on arm64: unbounded host-supplied vGIC used_lrs indexes list registers at EL2CVE-2026-64287 · Linux kernel KVM arm64 pKVM (vGIC used_lrs bound in flush_hyp_vcpu)High
• Linux kernel (drivers/iommu/intel): A device that does not support ATS never gets inserted into the VT-d deviceCVE-2026-74355 · Linux kernel (drivers/iommu/intel)High
• Linux kernel (arch/x86/kvm/svm): If AVIC is inhibited while a nested guest is running, KVM leaves the x2APIC MSRsCVE-2026-74516 · Linux kernel (arch/x86/kvm/svm)High