CVE-2026-53657: Lima Privilege Escalation Vulnerability

CVE-2026-53657 Overview

CVE-2026-53657 is a local privilege escalation vulnerability in Lima, an open-source project that launches Linux virtual machines (typically on macOS) for running containerd. The flaw affects Lima versions prior to 2.1.3 when running with the QEMU driver and the guest agent enabled. An unprivileged user inside the VM can access the /run/lima-guestagent.sock UNIX socket. Because the guest agent socket provides tunneling to arbitrary addresses, including UNIX sockets belonging to privileged daemons such as D-Bus, an attacker can leverage it to execute arbitrary commands as root inside the guest VM. The issue is tracked as [CWE-276: Incorrect Default Permissions] and is fixed in Lima 2.1.3.

Critical Impact
Any unprivileged user in a Lima guest VM can escalate to root by abusing the guest agent socket to tunnel into privileged daemons like D-Bus.

Affected Products

Lima (lima-vm/lima) versions prior to 2.1.3
Lima instances running with the qemu driver
Lima instances with the guest agent enabled

Discovery Timeline

2026-07-10 - CVE-2026-53657 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-53657

Vulnerability Analysis

Lima runs a helper process called the guest agent inside the Linux VM. This agent listens on the UNIX socket /run/lima-guestagent.sock and, among other functions, provides address tunneling so the host can reach services inside the VM. Prior to version 2.1.3, the socket was created with permissions that allowed any local user in the guest to open it. Because the agent tunnels to arbitrary UNIX socket addresses, an attacker can direct it at privileged endpoints inside the VM, such as the system D-Bus socket. Interacting with D-Bus enables invocation of privileged methods, resulting in arbitrary command execution as root within the guest.

Root Cause

The root cause is incorrect default permissions ([CWE-276]) on the guest agent UNIX socket. The Lima guest agent daemon did not restrict socket ownership to the main user, so any user in the VM could connect. Combined with the agent's ability to tunnel to arbitrary local addresses, this exposed privileged IPC endpoints to unprivileged callers.

Attack Vector

Exploitation requires local access to a Lima guest VM using the QEMU driver with the guest agent enabled. A local unprivileged user opens /run/lima-guestagent.sock, requests a tunnel to a privileged UNIX socket such as /var/run/dbus/system_bus_socket, and then issues D-Bus method calls that execute code with root privileges.

// Security patch: guestagent: limit the socket access to the main user
// cmd/lima-guestagent/daemon_linux.go
daemonCommand.Flags().Duration("tick", 3*time.Second, "Tick for polling events")
daemonCommand.Flags().Int("vsock-port", 0, "Use vsock server instead a UNIX socket")
daemonCommand.Flags().String("virtio-port", "", "Use virtio server instead a UNIX socket")
+daemonCommand.Flags().Int("socket-owner", 0, "UID of the main user that owns the UNIX socket (0 for root)")
return daemonCommand

Source: GitHub Commit 8a45892

The patch adds a --socket-owner flag that ties socket ownership to the main user UID, preventing other local users in the guest from opening the guest agent socket. A matching change was applied to the systemd installer:

// cmd/lima-guestagent/install_systemd_linux.go
installSystemdCommand.Flags().Bool("guestagent-updated", false, "Indicate that the guest agent has been updated")
installSystemdCommand.Flags().Int("vsock-port", 0, "Use vsock server on specified port")
installSystemdCommand.Flags().String("virtio-port", "", "Use virtio server instead a UNIX socket")
+installSystemdCommand.Flags().Int("socket-owner", 0, "UID of the main user that owns the UNIX socket (0 for root)")
return installSystemdCommand

Source: GitHub Commit b08cae8

Detection Methods for CVE-2026-53657

Indicators of Compromise

Unexpected connections to /run/lima-guestagent.sock from non-primary user accounts inside the guest VM.
Guest agent tunnel requests targeting privileged UNIX sockets such as /var/run/dbus/system_bus_socket.
New root-owned processes spawned by dbus-daemon or systemd units shortly after guest agent socket activity.

Detection Strategies

Audit file permissions on /run/lima-guestagent.sock and confirm ownership is restricted to the primary Lima user.
Enable Linux auditd rules to log connect() syscalls against the guest agent socket and correlate the calling UID.
Review Lima guest agent logs for tunnel requests referencing addresses other than the expected host-to-VM forwarding targets.

Monitoring Recommendations

Inventory macOS developer endpoints for Lima installations and record installed versions to identify pre-2.1.3 deployments.
Monitor privileged D-Bus method invocations in guest VMs and alert on invocations that originate from unexpected UIDs.
Track process ancestry inside guest VMs to detect root shells or command execution originating from unprivileged user sessions.

How to Mitigate CVE-2026-53657

Immediate Actions Required

Upgrade Lima to version 2.1.3 or later on all hosts running the QEMU driver.
Restart affected VMs after upgrade so the guest agent is relaunched with the corrected socket ownership.
Restrict guest VM access to trusted users only, since the vulnerability requires a local account inside the VM.

Patch Information

The fix is included in Lima v2.1.3 and documented in GitHub Security Advisory GHSA-2j9v-p4xj-cjw2. The patches at commit 8a45892 and commit b08cae8 introduce a --socket-owner flag so the guest agent socket is owned by the main user UID rather than being accessible to any user in the VM.

Workarounds

If immediate upgrade is not possible, disable the Lima guest agent in the VM configuration to remove the vulnerable socket.
Do not create additional local user accounts inside Lima guest VMs on vulnerable versions.
Consider switching to a non-QEMU driver where feasible until the upgrade to 2.1.3 is completed.

bash

# Verify Lima version and upgrade
limactl --version
brew upgrade lima   # macOS via Homebrew

# Confirm guest agent socket ownership inside the VM (should NOT be world-accessible)
limactl shell default -- ls -l /run/lima-guestagent.sock

# Optional: disable the guest agent in an instance configuration
# ~/.lima/<instance>/lima.yaml
# ---
# vmType: qemu
# guestAgent:
#   enabled: false