CVE-2026-63622
Libvirt: swtpm privilege escalation via symlink following
CVSS Score
7.8
EPSS Score
0.1%
EPSS Percentile
3th
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
| CWE | CWE-59 |
| Vendor | red hat |
| Product | red hat enterprise linux 10.0 extended update support |
| Published | Aug 10, 2026 |
| Last Updated | Sep 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat enterprise linux 10.0 extended update support
Be the first to know when new high vulnerabilities affecting red hat red hat enterprise linux 10.0 extended update support are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Support
All versions affected Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
All versions affected Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
All versions affected Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service
All versions affected Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 6
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux for NVIDIA 26
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2026:64773 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:65515 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:65516 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:65803 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:68513 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:68594 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:69114 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:69131 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-63622 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2513065
Credits
Red Hat would like to thank HE WEI (gikaku) for reporting this issue.