CVE-2026-77159

NameCVE-2026-77159
DescriptionA symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libvirt (PTS)bookworm9.0.0-4+deb12u2vulnerable
trixie11.3.0-3+deb13u3vulnerable
forky, sid12.7.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libvirtsource(unstable)12.7.0-1

Notes

https://gitlab.com/libvirt/libvirt/-/work_items/909
Fixed by: https://gitlab.com/libvirt/libvirt/-/commit/68e03ee02ff4826827f23d67d6b9eae49d7b9fb1 (v12.7.0-rc1)

Search for package or bug name: Reporting problems