libvirt swtpm state handling: symlink following lets the swtpm user take ownership of arbitrary files

Impact

virFileChownFiles() follows symbolic links when it fixes up ownership of the swtpm state directory. A process already running as the confined swtpm user can plant a symlink there and have the root libvirt daemon chown any file on the host to swtpm, which converts a contained sandbox into write control over root-owned files and from there into host root. This only matters on hypervisor hosts that give guests a virtual TPM, but that is a common configuration for confidential or attested VM offerings, which is precisely where GPU tenants are sold isolation as the product. The precondition is that the attacker already holds the swtpm sandbox, so this is a defence-in-depth failure rather than a first foothold.

Who can reach it

Local on the hypervisor host, and only from a process already executing as the confined swtpm user (typically reached by first compromising the swtpm process serving a guest vTPM). No network access and no libvirt credentials are needed.

What to do

Install the patched libvirt from your distribution (Red Hat ships it in RHSA-2026:64773, RHSA-2026:65515 and RHSA-2026:65516 for the affected RHEL streams) and restart the libvirt daemons. Restarting the modular libvirt daemons does not stop running domains, so this is a daemon restart per host rather than a drain, though the daemons briefly stop accepting management calls. Hosts that do not configure a vTPM for any guest are not exposed.

References

Related entries

• Linux kernel (arch/x86/kvm/svm): The SEV debug-encrypt path bounds each iteration by the source page offset but not theCVE-2026-63794 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-63881 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2026-63884 · Linux i915 GPU kernel driverHigh
• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High
• Linux kernel (net/smc): The SMC socket hashtables are re-initialised at the end of module init, after the protocol andCVE-2026-64005 · Linux kernel (net/smc)High
• Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyteCVE-2026-64009 · Linux kernel (net/xfrm)High