CVE-2026-102623

Name of the Vulnerable Software and Affected Versions KubeVirt (affected versions not specified)

Description An authenticated user with permissions to create Virtual Machine Instances (VMIs) can trigger a Denial of Service (DoS) by submitting a virtual machine definition containing an empty ephemeral volume. The virt-controller component does not properly validate the volume configuration, resulting in a nil-pointer dereference (an attempt to access a memory location that does not exist) and an application crash. Since the malformed definition remains in the cluster, the controller enters a continuous crash loop, which disrupts virtual machine lifecycle operations across the entire environment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.