Log in Start free

Vulnerability · Published Jul 20, 2026 · Assigned by redhat

CVE-2026-12080Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

High 7.3

In plain English

A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.1%top 96.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9qemu-guest-agent17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-img17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-audio-pa17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-block-blkio17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-block-curl17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-block-rbd17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-common17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-core17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-device-display-virtio-gpu17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-device-display-virtio-gpu-ccw17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-device-display-virtio-gpu-pci17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-device-display-virtio-vga17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-device-usb-host17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-device-usb-redirect17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-docs17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-tools17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-ui-egl-headless17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-kvm-ui-opengl17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
AlmaLinux:9qemu-pr-helper17:10.1.0-17.el9_8.9.alma.1ALSA-2026:88421
Debian:12qemuno fix listedDEBIAN-CVE-2026-12080
Debian:13qemuno fix listedDEBIAN-CVE-2026-12080
Debian:14qemu1:11.1.2+ds-1DEBIAN-CVE-2026-12080
Rocky Linux:9qemu-kvm7:10.1.0-17.el9_8.9RLSA-2026:88421
Ubuntu:22.04:LTSqemuno fix listedUBUNTU-CVE-2026-12080
Ubuntu:24.04:LTSqemuno fix listedUBUNTU-CVE-2026-12080
Ubuntu:26.04:LTSqemuno fix listedUBUNTU-CVE-2026-12080
Ubuntu:26.10qemuno fix listedUBUNTU-CVE-2026-12080
Ubuntu:26.04:LTSqemu-hweno fix listedUBUNTU-CVE-2026-12080
Ubuntu:26.10qemu-hweno fix listedUBUNTU-CVE-2026-12080

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux for NVIDIA 26 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 5 see references

Weakness: CWE-61 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References