CVE-2026-13201Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

Description

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.

Timeline

Scores

EPSS (exploitation in 30 days)

0.31% · top 76% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Affected products

• Red Hat · Red Hat Container Native Virtualization 4.12

  • unaffected 1791522624 – < *

• Red Hat · Red Hat Container Native Virtualization 4.13

  • unaffected 1786346596 – < *

• Red Hat · Red Hat Container Native Virtualization 4.14

  • unaffected 1786309624 – < *

• Red Hat · Red Hat Container Native Virtualization 4.15

  • unaffected 1786347656 – < *

• Red Hat · Red Hat Container Native Virtualization 4.16

  • unaffected 1786030071 – < *

• Red Hat · Red Hat Container Native Virtualization 4.17

  • unaffected 1786348529 – < *

• Red Hat · Red Hat Container Native Virtualization 4.18

  • unaffected 1786130068 – < *

• Red Hat · Red Hat Container Native Virtualization 4.19

  • unaffected 1786334215 – < *

• Red Hat · Red Hat Container Native Virtualization 4.20

  • unaffected 1785831334 – < *

• Red Hat · Red Hat Container Native Virtualization 4.21

  • unaffected 1785829701 – < *

• Red Hat · Red Hat Container Native Virtualization 4.22

  • unaffected 1785140336 – < *

What to do

Workaround: The following measures reduce the attacker pool and limit secondary impact: Review RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem. Ensure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels. RHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path. Note: no mitigation currently addresses the notify socket hijacking vector. The attacker's ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-39086 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-13201](https://cveledger.app/badge/CVE-2026-13201.svg)](https://cveledger.app/cve/CVE-2026-13201)

Record last updated 12 Oct 2026, 20:47 UTC.