CVE-2026-77159
Fixed in a distro release EPSS <1%CVSS 5.5
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libvirt | no fix |
| Debian 13 | libvirt | no fix |
| Debian 14 | libvirt | 12.7.0-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | libvirt | 8.0.0-150400.7.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | libvirt | 8.0.0-150400.7.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | libvirt | 9.0.0-150500.6.29.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | libvirt | 9.0.0-150500.6.29.1 |
| SUSE Linux Enterprise Micro 5.3 | libvirt | 8.0.0-150400.7.17.1 |
| SUSE Linux Enterprise Micro 5.4 | libvirt | 8.0.0-150400.7.17.1 |
| SUSE Linux Enterprise Micro 5.5 | libvirt | 9.0.0-150500.6.29.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | libvirt | 11.0.0-150700.4.27.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | libvirt | 11.0.0-150700.4.27.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | libvirt | 5.1.0-13.48.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | libvirt | 8.0.0-150400.7.17.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | libvirt | 9.0.0-150500.6.29.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | libvirt | 10.0.0-150600.8.18.1 |
| SUSE Linux Enterprise Server 16.0 | libvirt | 11.4.0-160000.5.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | libvirt | 5.1.0-13.48.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | libvirt | 8.0.0-150400.7.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | libvirt | 9.0.0-150500.6.29.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | libvirt | 10.0.0-150600.8.18.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | libvirt | 11.4.0-160000.5.1 |
| SUSE Linux Micro 6.0 | libvirt | 10.0.0-5.1 |
| SUSE Linux Micro 6.1 | libvirt | 10.0.0-slfo.1.1_3.1 |
| SUSE Linux Micro 6.2 | libvirt | 11.4.0-160000.5.1 |
| Ubuntu 22.04 LTS | libvirt | 8.0.0-1ubuntu7.21 |
| Ubuntu 24.04 LTS | libvirt | 10.0.0-2ubuntu8.19 |
| Ubuntu 26.04 LTS | libvirt | 12.0.0-1ubuntu5.5 |
| Ubuntu 26.04 LTS | libvirt-hwe | 12.0.0-1ubuntu5.5 |
| Ubuntu Pro 14.04 LTS | libvirt | no fix |
| Ubuntu Pro 16.04 LTS | libvirt | no fix |
| Ubuntu Pro 18.04 LTS | libvirt | no fix |
| Ubuntu Pro 20.04 LTS | libvirt | no fix |
| openSUSE Leap 16.0 | libvirt | 11.4.0-160000.5.1 |
| openSUSE Tumbleweed | libvirt | 12.6.0-2.1 |