Vulnerability · Published Sep 11, 2026 · Assigned by redhat
CVE-2026-77159Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
Medium 5.5
In plain English
A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libvirt | no fix listed | DEBIAN-CVE-2026-77159 |
| Debian:13 | libvirt | no fix listed | DEBIAN-CVE-2026-77159 |
| Debian:14 | libvirt | 12.7.0-1 | DEBIAN-CVE-2026-77159 |
| Ubuntu:22.04:LTS | libvirt | 8.0.0-1ubuntu7.21 | UBUNTU-CVE-2026-77159 |
| Ubuntu:22.04:LTS | libvirt | 8.0.0-1ubuntu7.21 | USN-8831-1 |
| Ubuntu:24.04:LTS | libvirt | 10.0.0-2ubuntu8.19 | USN-8831-1 |
| Ubuntu:24.04:LTS | libvirt | 10.0.0-2ubuntu8.19 | UBUNTU-CVE-2026-77159 |
| Ubuntu:26.04:LTS | libvirt | 12.0.0-1ubuntu5.5 | USN-8831-1 |
| Ubuntu:26.04:LTS | libvirt | 12.0.0-1ubuntu5.5 | UBUNTU-CVE-2026-77159 |
| Ubuntu:26.04:LTS | libvirt-hwe | 12.0.0-1ubuntu5.5 | USN-8833-1 |
| Ubuntu:26.04:LTS | libvirt-hwe | 12.0.0-1ubuntu5.5 | UBUNTU-CVE-2026-77159 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-61 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-77159 vdb-entry, x_refsource_REDHAT
- RHBZ#2531811 issue-tracking, x_refsource_REDHAT
- https://gitlab.com/libvirt/libvirt/-/work_items/909