CVE-2026-63622
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability was found in libvirt where the virFileChownFiles() function follows symbolic links. A local attacker running as the swtpm user can plant a symlink in the swtpm state directory, causing the root-level libvirt daemon to change ownership of an arbitrary file to the swtpm user.
Risk Assessment
This allows privilege escalation from the swtpm sandbox to root-level file ownership control, potentially leading to system compromise.
Recommendation
Apply vendor patches for libvirt and restrict access to the swtpm state directory.
Original NVD description (English source)
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.