A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
References
Configurations
No configuration.
History
05 Oct 2026, 09:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Oct 2026, 05:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Sep 2026, 06:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Sep 2026, 04:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Sep 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Sep 2026, 08:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2026-08-10 21:17
Updated : 2026-10-05 09:17
NVD link : CVE-2026-63622
Mitre link : CVE-2026-63622
CVE.ORG link : CVE-2026-63622
JSON object : View
Products Affected
No product.
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')