CVE-2026-12080: QEMU Guest Agent Privilege Escalation Flaw

CVE-2026-12080 Overview

CVE-2026-12080 is a symbolic link handling flaw in the QEMU Guest Agent (qga) that enables local privilege escalation to root within a guest virtual machine. The vulnerability resides in the guest-ssh-add-authorized-keys command handler and is classified under [CWE-61] (UNIX Symbolic Link Following). A local unprivileged user can exploit either a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation grants ownership of arbitrary root-owned files or directories. The affected code path requires an external management layer such as libvirt to invoke the vulnerable command.

Critical Impact
Local unprivileged users in QEMU guests can gain ownership of arbitrary root-owned files, resulting in full root compromise of the guest operating system.

Affected Products

QEMU Guest Agent (qga) — versions containing the guest-ssh-add-authorized-keys handler
Linux distributions shipping the affected qemu-guest-agent package (see Red Hat advisory)
Virtualization environments using libvirt or equivalent management layers that invoke the vulnerable handler

Discovery Timeline

2026-07-20 - CVE-2026-12080 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-12080

Vulnerability Analysis

The QEMU Guest Agent runs as root inside a guest VM and exposes commands invoked by the host through a virtio-serial channel. The guest-ssh-add-authorized-keys command writes SSH public keys into a target user's ~/.ssh/authorized_keys file. The handler performs path resolution and file operations without safely accounting for symbolic links planted by a local unprivileged attacker inside the guest.

Two distinct attack primitives exist. The first is a deterministic directory-symlink bypass, where the attacker replaces a directory component of the resolved path with a symlink pointing at a root-owned directory. The second is a TOCTOU race between the agent's validation checks and the subsequent file operation, allowing the attacker to swap a benign file for a symlink pointing at a root-owned target.

Because qga performs chown or write operations on the resolved target while running as root, the attacker gains ownership of the referenced file or directory. Ownership of a system file such as /etc/passwd or /etc/shadow trivially yields root access.

Root Cause

The handler resolves user-controlled path components without using symlink-safe APIs such as openat2 with RESOLVE_NO_SYMLINKS or equivalent atomic checks. Path checks and file operations are not performed on the same file descriptor, introducing the TOCTOU window.

Attack Vector

Exploitation requires local access inside the guest and an external management layer that triggers the guest-ssh-add-authorized-keys command. The attacker pre-positions symlinks within the target user's home directory, then waits for or induces the host management stack to invoke the vulnerable command. See the Red Hat CVE-2026-12080 Advisory and the GitLab QEMU Work Item #3929 for upstream technical details.

Detection Methods for CVE-2026-12080

Indicators of Compromise

Unexpected ownership changes on root-owned files or directories, particularly within /etc, /root, or system binaries directories inside a guest VM.
Presence of symbolic links inside user home directories at paths such as ~/.ssh or ~/.ssh/authorized_keys that point outside the user's home tree.
qemu-guest-agent audit records showing guest-ssh-add-authorized-keys invocations followed by anomalous filesystem state changes.

Detection Strategies

Monitor qemu-ga process activity for chown, open, and openat syscalls that resolve to paths outside the invoking user's home directory.
Enable Linux audit rules on /etc/passwd, /etc/shadow, and /etc/sudoers.d/ to flag ownership modifications performed by qemu-ga.
Correlate host-side libvirt API calls invoking guest-ssh-add-authorized-keys with guest-side filesystem change events.

Monitoring Recommendations

Deploy Linux endpoint telemetry inside guest VMs. Singularity Endpoint provides behavioral AI-powered protection across Linux distributions and can surface anomalous privileged file operations performed by qemu-ga.
Forward auditd and qemu-ga logs to a centralized data lake. Singularity Data Lake supports OCSF-normalized ingestion for correlation of host and guest events.
Alert on any process running as root that follows a user-owned symlink into a system-owned path.

How to Mitigate CVE-2026-12080

Immediate Actions Required

Apply vendor updates for qemu-guest-agent as soon as distribution patches become available. Track status through the Red Hat CVE-2026-12080 Advisory.
Audit which guest VMs expose guest-ssh-add-authorized-keys through the host management layer and restrict invocation to trusted administrators only.
Review guest VMs for pre-positioned symbolic links inside user home directories that reference system paths.

Patch Information

Upstream fixes are tracked in GitLab QEMU Work Item #3929 and downstream in Red Hat Bug Report #2499603. Distribution maintainers are expected to backport the fix into their qemu-guest-agent packages. Verify installed package versions against vendor advisories before considering the guest patched.

Workarounds

Disable the guest-ssh-add-authorized-keys command in the QEMU Guest Agent configuration file using the --block-rpcs option until patches are applied.
Restrict libvirt or equivalent management-layer permissions so that only trusted operators can invoke guest agent commands.
Where SSH key provisioning is not required, remove or mask the qemu-guest-agent service inside guests that do not need agent functionality.

bash

# Block the vulnerable RPC in the QEMU guest agent configuration
# /etc/sysconfig/qemu-ga (RHEL/Fedora) or /etc/default/qemu-guest-agent (Debian/Ubuntu)
BLACKLIST_RPCS="guest-ssh-add-authorized-keys,guest-ssh-remove-authorized-keys,guest-ssh-get-authorized-keys"

# Restart the agent to apply
systemctl restart qemu-guest-agent

# Verify the command is disabled
virsh qemu-agent-command <domain> '{"execute":"guest-info"}' | grep -i ssh