CVE-2026-63622: libvirt Privilege Escalation Vulnerability

CVE-2026-63622 Overview

CVE-2026-63622 is a symlink-following vulnerability in the libvirt virtualization management library. The flaw resides in the virFileChownFiles() function, which fails to validate symbolic links before changing file ownership. A local attacker running as the confined swtpm user can plant a symlink inside the swtpm state directory and trick the root-privileged libvirt daemon into transferring ownership of arbitrary files on the host to the swtpm account. This weakness is classified under [CWE-59] (Improper Link Resolution Before File Access). Exploitation enables escape from the swtpm sandbox and effective control over system files through ownership manipulation.

Critical Impact
A local swtpm process can escalate to root-level file ownership control on affected libvirt hosts, undermining host isolation for virtual TPM workloads.

Affected Products

libvirt (upstream virtualization management daemon)
Red Hat Enterprise Linux distributions shipping affected libvirt builds
Systems using swtpm integration through libvirt-managed virtual machines

Discovery Timeline

2026-08-10 - CVE-2026-63622 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-63622

Vulnerability Analysis

The vulnerability exists in libvirt's virFileChownFiles() helper, which recursively changes ownership of files within a target directory. libvirt invokes this function as root when preparing per-domain state directories for the swtpm (software TPM) emulator. The routine performs chown() operations without validating whether directory entries are regular files or symbolic links pointing outside the intended directory tree.

The swtpm process, although sandboxed under a dedicated unprivileged user, retains write access to its own state directory. An attacker controlling this process can place a symlink where libvirt expects a regular file. When libvirt next reconciles ownership, the kernel follows the symlink and applies the ownership change to the target path chosen by the attacker.

This category of flaw is a classic Time-of-Check Time-of-Use (TOCTOU) filesystem race combined with unsafe link resolution. The attack vector is local and requires only low privileges already held by the swtpm service account.

Root Cause

The root cause is missing O_NOFOLLOW / AT_SYMLINK_NOFOLLOW semantics inside virFileChownFiles(). The function trusts directory contents and calls chown() on paths that traverse symbolic links. Because libvirt runs as root and swtpm state directories are writable by an unprivileged user, the trust boundary between the daemon and the confined helper is violated.

Attack Vector

An attacker who has already compromised a process running as the swtpm user, for example through a bug in the swtpm emulator itself, prepares the exploit inside the per-domain state directory. The attacker removes a legitimate state file and replaces it with a symbolic link pointing to a sensitive target such as /etc/shadow, an SSH key, or a systemd unit file. On the next libvirt operation that triggers virFileChownFiles(), the daemon changes ownership of the pointed-to file to the swtpm user. The attacker can then modify that file directly and pivot to full root compromise. No user interaction is required and the complexity is low.

No public proof-of-concept exploit code is available at the time of publication. See the Red Hat CVE-2026-63622 Advisory and Red Hat Bug Report #2513065 for upstream technical details.

Detection Methods for CVE-2026-63622

Indicators of Compromise

Symbolic links present inside /var/lib/libvirt/swtpm/<domain-uuid>/ that point outside the state directory tree.
Sensitive system files (for example /etc/shadow, files under /root/.ssh/, or systemd units) unexpectedly owned by the swtpm user or group.
chown audit records generated by the libvirt daemon (libvirtd or virtqemud) targeting paths outside expected swtpm state directories.

Detection Strategies

Enable Linux Audit rules on chown, fchownat, and lchown syscalls originating from libvirt-related processes and correlate targets against an allow-list of state directories.
Baseline the ownership of critical system files and alert on transitions to the swtpm UID or GID.
Inspect libvirt state directories periodically for symbolic links; legitimate swtpm state files are regular files.

Monitoring Recommendations

Forward auditd, SELinux AVC denials, and libvirt logs to a centralized analytics pipeline for correlation across hosts.
Monitor for anomalous privilege transitions where files owned by root become owned by low-privilege service accounts.
Alert on any file creation events under swtpm state directories that produce symlink inodes rather than regular files.

How to Mitigate CVE-2026-63622

Immediate Actions Required

Apply the libvirt security update from your distribution vendor as soon as it is available; consult the Red Hat CVE-2026-63622 Advisory for package versions.
Audit swtpm state directories on all virtualization hosts for existing symbolic links and remove any that are not expected.
Verify ownership of sensitive system files and restore correct ownership where the swtpm account has been assigned unexpectedly.

Patch Information

Red Hat has assigned CVE-2026-63622 and tracks the fix under Bugzilla #2513065. The upstream fix modifies virFileChownFiles() to reject symbolic links during recursive ownership changes, using symlink-safe syscall variants. Administrators should install patched libvirt packages and restart the libvirt daemon (libvirtd, virtqemud, or the modular equivalents in use) to load the fixed code paths.

Workarounds

Disable swtpm integration for virtual machines that do not require a virtual TPM until patches are applied.
Tighten SELinux or AppArmor policy on the swtpm domain to prevent creation of symbolic links inside state directories.
Restrict local access to virtualization hosts so that untrusted users cannot influence the swtpm process.

bash

# Audit swtpm state directories for unexpected symbolic links
find /var/lib/libvirt/swtpm -type l -printf '%p -> %l\n'

# List host files currently owned by the swtpm account (investigate any outside /var/lib/libvirt/swtpm)
find / -xdev \( -user tss -o -group tss \) -not -path '/var/lib/libvirt/swtpm/*' 2>/dev/null