CVE-2026-13201

Fixed in a distro release EPSS <1%CVSS 7.3

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Published 2026-06-24 · CVE record · OSV

Products: Red Hat Container Native Virtualization 4.12, Red Hat Container Native Virtualization 4.13, Red Hat Container Native Virtualization 4.14, Red Hat Container Native Virtualization 4.15, Red Hat Container Native Virtualization 4.16, Red Hat Container Native Virtualization 4.17, Red Hat Container Native Virtualization 4.18, Red Hat Container Native Virtualization 4.19, Red Hat Container Native Virtualization 4.20, Red Hat Container Native Virtualization 4.21, Red Hat Container Native Virtualization 4.22

Distro releases