High severity7.8NVD Advisory· Published Aug 10, 2026· Updated Nov 4, 2026
CVE-2026-63622
CVE-2026-63622
Description
A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
34- osv-coords33 versionspkg:rpm/almalinux/libvirtpkg:rpm/almalinux/libvirt-clientpkg:rpm/almalinux/libvirt-client-qemupkg:rpm/almalinux/libvirt-daemonpkg:rpm/almalinux/libvirt-daemon-commonpkg:rpm/almalinux/libvirt-daemon-config-networkpkg:rpm/almalinux/libvirt-daemon-config-nwfilterpkg:rpm/almalinux/libvirt-daemon-driver-interfacepkg:rpm/almalinux/libvirt-daemon-driver-networkpkg:rpm/almalinux/libvirt-daemon-driver-nodedevpkg:rpm/almalinux/libvirt-daemon-driver-nwfilterpkg:rpm/almalinux/libvirt-daemon-driver-qemupkg:rpm/almalinux/libvirt-daemon-driver-secretpkg:rpm/almalinux/libvirt-daemon-driver-storagepkg:rpm/almalinux/libvirt-daemon-driver-storage-corepkg:rpm/almalinux/libvirt-daemon-driver-storage-diskpkg:rpm/almalinux/libvirt-daemon-driver-storage-iscsipkg:rpm/almalinux/libvirt-daemon-driver-storage-logicalpkg:rpm/almalinux/libvirt-daemon-driver-storage-mpathpkg:rpm/almalinux/libvirt-daemon-driver-storage-rbdpkg:rpm/almalinux/libvirt-daemon-driver-storage-scsipkg:rpm/almalinux/libvirt-daemon-kvmpkg:rpm/almalinux/libvirt-daemon-lockpkg:rpm/almalinux/libvirt-daemon-logpkg:rpm/almalinux/libvirt-daemon-plugin-lockdpkg:rpm/almalinux/libvirt-daemon-plugin-sanlockpkg:rpm/almalinux/libvirt-daemon-proxypkg:rpm/almalinux/libvirt-develpkg:rpm/almalinux/libvirt-docspkg:rpm/almalinux/libvirt-libspkg:rpm/almalinux/libvirt-nsspkg:rpm/almalinux/libvirt-ssh-proxypkg:rpm/opensuse/libvirt&distro=openSUSE%20Leap%2016.0
< 11.10.0-12.7.el9_8.alma.1+ 32 more
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.10.0-12.7.el9_8.alma.1
- (no CPE)range: < 11.4.0-160000.5.1
Patches
Vulnerability mechanics
References
12- access.redhat.com/errata/RHSA-2026:64773nvd
- access.redhat.com/errata/RHSA-2026:65515nvd
- access.redhat.com/errata/RHSA-2026:65516nvd
- access.redhat.com/errata/RHSA-2026:65803nvd
- access.redhat.com/errata/RHSA-2026:68513nvd
- access.redhat.com/errata/RHSA-2026:68594nvd
- access.redhat.com/errata/RHSA-2026:69114nvd
- access.redhat.com/errata/RHSA-2026:69131nvd
- access.redhat.com/errata/RHSA-2026:74424nvd
- access.redhat.com/errata/RHSA-2026:75583nvd
- access.redhat.com/security/cve/CVE-2026-63622nvd
- bugzilla.redhat.com/show_bug.cginvd
News mentions
0No linked articles in our index yet.