CVE-2026-13322: KubeVirt Downward Metrics DoS Vulnerability

CVE-2026-13322 Overview

CVE-2026-13322 is a resource exhaustion flaw in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character arrives. No length limit or read deadline is enforced on this operation. A user with access to a virtual machine (VM) guest configured with the downward metrics virtio-serial device can write a continuous byte stream to the device. This causes unbounded memory allocation in the virt-handler process on the host until it is terminated by the out-of-memory (OOM) killer. The weakness is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
A malicious guest can exhaust host memory and cause the KubeVirt virt-handler process to be OOM-killed, degrading availability of virtualization services on the affected node.

Affected Products

KubeVirt with the downward metrics virtio-serial device enabled
Red Hat OpenShift Virtualization deployments using affected KubeVirt versions
Kubernetes clusters running KubeVirt virt-handler with downward metrics feature

Discovery Timeline

2026-06-26 - CVE CVE-2026-13322 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-13322

Vulnerability Analysis

KubeVirt exposes host and pod metadata to virtual machines through a downward metrics channel implemented over virtio-serial. The virt-handler component runs a server on the host side of this channel. It parses incoming guest requests using Go's textproto.Reader.ReadLine() function, which accumulates bytes into an internal buffer until it encounters a newline delimiter. The implementation applies neither a maximum line length nor an I/O read deadline. A guest process with write access to the virtio-serial device can therefore stream arbitrary volumes of data without ever terminating a line.

Each byte received grows the buffer inside virt-handler. As allocation continues, the process consumes host memory beyond its expected working set. The Linux kernel eventually invokes the OOM killer against virt-handler, disrupting VM lifecycle management and metrics collection on that node. Because virt-handler runs at node scope, the impact extends to all VMs scheduled on the affected host, not only the malicious guest. The scope change reflects this cross-boundary effect.

Root Cause

The root cause is missing input bounds on a host-side parser that trusts guest-supplied data. textproto.Reader.ReadLine() grows its buffer without a ceiling. The KubeVirt server neither wraps the reader in an io.LimitReader nor sets a SetReadDeadline on the underlying connection. Any guest able to write to /dev/virtio-ports/* for the downward metrics device can trigger the condition.

Attack Vector

Exploitation requires local access to a VM guest with low privileges sufficient to write to the downward metrics virtio-serial device. The attacker opens the device file inside the guest and writes a continuous stream of non-newline bytes. See the Red Hat CVE Advisory and Red Hat Bug Report #2492681 for authoritative technical details.

Detection Methods for CVE-2026-13322

Indicators of Compromise

Kernel OOM killer log entries on Kubernetes nodes referencing the virt-handler process
Sudden growth of resident set size (RSS) for virt-handler pods without a corresponding workload increase
Repeated restarts of the virt-handler DaemonSet pods on one or more nodes
Guest-side processes holding an open write handle to a downward metrics virtio-serial device for extended periods

Detection Strategies

Monitor container and process memory metrics for virt-handler and alert on sustained growth exceeding baseline
Correlate virt-handler restarts with node-level OOM events using kubelet and kernel logs
Audit VM configurations for the presence of the downward metrics virtio-serial device and identify which workloads have write access

Monitoring Recommendations

Collect Prometheus metrics for container_memory_working_set_bytes on virt-handler pods and set alerts on rapid deltas
Forward dmesg and journald OOM-kill records to a centralized log platform for correlation across nodes
Track KubeVirt control-plane events for repeated virt-handler pod terminations tied to memory pressure

How to Mitigate CVE-2026-13322

Immediate Actions Required

Inventory all VMs that enable the downward metrics virtio-serial device and restrict this feature to trusted workloads
Apply KubeVirt updates as they are released by the upstream project and by downstream distributors such as Red Hat OpenShift Virtualization
Enforce Kubernetes memory limits on the virt-handler DaemonSet to contain blast radius while patches are validated
Restrict guest-level access so that untrusted users inside VMs cannot open the downward metrics device for writing

Patch Information

Refer to the Red Hat CVE Advisory and Red Hat Bug Report #2492681 for fixed versions and errata. Upstream KubeVirt fixes introduce bounded reads and deadlines on the downward metrics server socket.

Workarounds

Disable the downward metrics virtio-serial device on VMs that do not require it by removing the downwardMetrics entry from the VM specification
Apply strict cgroup memory limits on virt-handler pods so kernel enforcement contains allocation growth before node-wide impact
Limit which guest users and processes can write to /dev/virtio-ports/* devices through in-guest access controls

bash

# Remove the downwardMetrics device from a VirtualMachine spec
kubectl patch vm <vm-name> --type=json \
  -p='[{"op":"remove","path":"/spec/template/spec/domain/devices/downwardMetrics"}]'

# Enforce a memory limit on the virt-handler DaemonSet as a defense-in-depth measure
kubectl -n kubevirt set resources daemonset/virt-handler \
  --limits=memory=512Mi --requests=memory=256Mi