libvirt: symlink-following chown on the swtpm logfile hands arbitrary file ownership to the swtpm user

Impact

libvirtd runs as root and chowns the swtpm logfile by path without checking for symlinks. A local attacker who already controls the swtpm account can point that path at any file on the host and have libvirtd transfer its ownership to swtpm, which is a stepping stone to further privilege escalation on the hypervisor. On a GPU host running VMs with passed-through accelerators, the hypervisor is the trust boundary between tenant VMs and the fabric, so any root-mediated file operation that a lower-privileged service account can redirect is worth closing. Exploitation requires prior control of the swtpm account, which limits this to chained attacks rather than a direct tenant-to-root jump.

Who can reach it

Local, authenticated: an attacker who already has code execution as the swtpm service account on the virtualization host. Not reachable from a guest or from the network on its own.

What to do

Apply the libvirt update from your distribution when it ships (Red Hat tracks this across RHEL 6 through 10; check the vendor link for the fixed build for your release). Applying it means restarting libvirtd, which does not require stopping running guests but does interrupt management operations briefly - a daemon restart rather than a node drain. Until a package is available, no mitigation is named in the advisory beyond restricting access to the swtpm account and hosts that do not use emulated TPM are not exposed.

References

Related entries

• Linux kernel bpf: arena 32-bit cmpxchg misses zero extension of the result registerCVE-2026-98049 · Linux kernel BPF verifier (missing zero-extension for arena 32-bit cmpxchg)Medium
• Linux kernel BPF: tp_btf program dereferencing SEND_SIG_NOINFO can panic the nodeCVE-2026-98062 · Linux kernel BPF (signal_generate/signal_deliver raw tracepoint arguments)Medium
• Linux kernel BPF verifier: dead zero spill downgraded to STACK_ZERO breaks precision trackingCVE-2026-98132 · Linux kernel BPF verifier (scalar zero spill downgraded to STACK_ZERO)Medium
• Linux kernel BPF verifier: pointer comparison wrongly infers non-null, allowing a missed NULL derefCVE-2026-98134 · Linux kernel BPF verifier (check_cond_jmp_op null inference)Medium
• Linux kernel nvmet-rdma: queue and IB resources leak when the connect backlog is exceededCVE-2026-98152 · Linux kernel nvmet-rdma (NVMe-oF RDMA target connect path)Medium
• AMD SEV-ES (CacheWarp): CacheWarp: INVD lets a malicious hypervisor revert SEV-ES guest memory writes, breaking guestCVE-2023-20592 · AMD SEV-ES (CacheWarp)Medium