High

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

Type: advisorySource: Official CVE List1 source record

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Announced 24 Jun 2026Source revision 1

Original source ↗

CVE-2026-13201

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-13201

Red Hat Container Native Virtualization 4.12

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.13

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.14

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.15

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.16

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.17

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.18

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.19

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.20

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.21

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Container Native Virtualization 4.22

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.12::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.12",
    "versions": [
      {
        "status": "unaffected",
        "version": "1791522624",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.13::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.13",
    "versions": [
      {
        "status": "unaffected",
        "version": "1786346596",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.14::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.14",
    "versions": [
      {
        "status": "unaffected",
        "version": "1786309624",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.15::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.15",
    "versions": [
      {
        "status": "unaffected",
        "version": "1786347656",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.16::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.16",
    "versions": [
      {
        "status": "unaffected",
        "version": "1786030071",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.17::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.17",
    "versions": [
      {
        "status": "unaffected",
        "version": "1786348529",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.18::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.18",
    "versions": [
      {
        "status": "unaffected",
        "version": "1786130068",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.19::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.19",
    "versions": [
      {
        "status": "unaffected",
        "version": "1786334215",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.20::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.20",
    "versions": [
      {
        "status": "unaffected",
        "version": "1785831334",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.21::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.21",
    "versions": [
      {
        "status": "unaffected",
        "version": "1785829701",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:container_native_virtualization:4.22::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Container Native Virtualization 4.22",
    "versions": [
      {
        "status": "unaffected",
        "version": "1785140336",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "container-native-virtualization/virt-handler-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  }
]

Related CVEs: CVE-2026-13201
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #17109 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 01:27:26 GMT
Publisher date: Wed, 24 Jun 2026 20:39:00 GMT

Read the original announcement