access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-63622 CVE-2026-63622
HIGH
Libvirt: swtpm privilege escalation via symlink following
Record summary
CVE-2026-63622 has a selected CVSS score of 7.8 (high).
Description
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List
Affected products and versions
6| Product | Source | Version range | Status |
|---|---|---|---|
Default status: affected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: affected | CVE List | Version data not supplied | |
Default status: affected | CVE List | Version data not supplied | |
Default status: affected | CVE List | Version data not supplied | |
Red Hat Enterprise Linux for NVIDIA 26Browse Red Hat / Red Hat Enterprise Linux for NVIDIA 26libvirtDefault status: unknown | CVE List | Version data not supplied | |
References
3RHBZ#2513065issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2513065 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-63622