libvirt swtpm state handling: symlink following lets the swtpm user take ownership of arbitrary files

Impact

virFileChownFiles() follows symbolic links when it fixes up ownership of the swtpm state directory. A process already running as the confined swtpm user can plant a symlink there and have the root libvirt daemon chown any file on the host to swtpm, which converts a contained sandbox into write control over root-owned files and from there into host root. This only matters on hypervisor hosts that give guests a virtual TPM, but that is a common configuration for confidential or attested VM offerings, which is precisely where GPU tenants are sold isolation as the product. The precondition is that the attacker already holds the swtpm sandbox, so this is a defence-in-depth failure rather than a first foothold.

Who can reach it

Local on the hypervisor host, and only from a process already executing as the confined swtpm user (typically reached by first compromising the swtpm process serving a guest vTPM). No network access and no libvirt credentials are needed.

What to do

Install the patched libvirt from your distribution (Red Hat ships it in RHSA-2026:64773, RHSA-2026:65515 and RHSA-2026:65516 for the affected RHEL streams) and restart the libvirt daemons. Restarting the modular libvirt daemons does not stop running domains, so this is a daemon restart per host rather than a drain, though the daemons briefly stop accepting management calls. Hosts that do not configure a vTPM for any guest are not exposed.

References

Related entries

• Linux kernel (arch/x86/kvm/svm): The SEV debug-encrypt path bounds each iteration by the source page offset but not theCVE-2026-63794 · Linux kernel (arch/x86/kvm/svm)High
• Linux bpf: sysctl write buffer allocated with kvzalloc but freed with kfree, corrupting memoryCVE-2026-63809 · Linux kernel BPF cgroup sysctl hook (__cgroup_bpf_run_filter_sysctl buffer free)High
• Linux keys: unpinned request_key_auth payload lets KEYCTL_INSTANTIATE race into a use-after-freeCVE-2026-63823 · Linux kernel keyring (request_key_auth payload refcounting)High
• Linux KEYS: miscalculated output buffer length overflows on keyctl asymmetric key operationsCVE-2026-63824 · Linux kernel keyring asymmetric key ops (keyctl_pkey_params_get_2)High
• Linux arm64: stale page-table entry left in the walk cache when a hugetlb PMD table is unsharedCVE-2026-63875 · Linux kernel arm64 TLB maintenance (tlb_flush on hugetlb PMD unshare)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-63881 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High