CVE-2026-63622

Name of the Vulnerable Software and Affected Versions libvirt (affected versions not specified)

Description A symlink-following flaw exists in the virFileChownFiles() function. A local attacker operating as the confined swtpm user can place a symbolic link in the swtpm state directory to trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user, enabling privilege escalation from the sandbox to root-level file ownership control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.