Status: UPDATED
| Advisory ID: CVE-2026-13201
Key Details
| CVE | CVE-2026-13201 |
| CVSS Score / Version | 7.3 (High) / CVSS v3.1 |
| Updated | 2026-09-21 |
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H |
| CVSS Prose | attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is none; integrity impact is low; availability impact is high. |
| Affected products | see table below |
| Classified as | CWE-61 (UNIX Symbolic Link (Symlink) Following) |
Affected Products, Subsystems & Sectors
| Subsystems | General OT |
| Sectors | Multiple |
What to Know
A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths. (NVD)
What to Do
Monitor kubevirt's and Red Hat's web pages for any future patch releases. See vendor advisory link below.
References