CVE-2026-63622: 
Linux Red Hat 脆弱性の分析と軽減

CVE-2026-63622 is a symlink-following (CWE-59) privilege escalation vulnerability in libvirt's virFileChownFiles() function. A local attacker running as the confined swtpm user can plant a symbolic link within the swtpm state directory, causing the root-level libvirt daemon to change ownership of an arbitrary file to the swtpm user. The vulnerability affects Red Hat libvirt (specific fixed versions not yet published at time of disclosure) and was published on August 10, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Github Advisory).

The root cause is improper link resolution (CWE-59) in virFileChownFiles() located in src/util/virfile.c, which is invoked from src/qemu/qemu_tpm.c when starting a QEMU domain with a virtual TPM device. The function used stat() (via virFileIsRegular()) and chown(), both of which follow symbolic links, allowing a process running as the confined swtpm user (tss) to plant a symlink inside the swtpm state directory pointing to an arbitrary system file. When the root-level libvirt daemon starts the next domain, it calls virFileChownFiles(), follows the symlink, and changes ownership of the target file to the tss user. The upstream fix replaces stat()/chown() with lstat()/lchown() to avoid following symlinks on the final path component (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a local attacker with swtpm user privileges to escalate from the confined swtpm sandbox to root-level file ownership control over arbitrary files on the host system. This can result in high confidentiality, integrity, and availability impacts — an attacker could change ownership of sensitive system files (e.g., /etc/shadow, SSH keys, or service binaries), enabling further privilege escalation to full root compromise, data exfiltration, or denial of service (Red Hat CVE, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access as the confined swtpm user, limiting the attack surface to systems running libvirt with virtual TPM (vTPM) functionality enabled (Github Advisory, Red Hat CVE).

1. Gain swtpm user access: Obtain code execution as the confined swtpm (tss) user on a host running libvirt with vTPM-enabled virtual machines — for example, by exploiting a vulnerability in the swtpm process itself.
2. Identify the swtpm state directory: Locate the directory used by libvirt to store swtpm state files (typically under /var/lib/libvirt/swtpm/<domain-uuid>/).
3. Plant a symbolic link: As the swtpm user, create a symbolic link within the swtpm state directory pointing to a sensitive target file (e.g., ln -s /etc/shadow /var/lib/libvirt/swtpm/<uuid>/tpm2/tpm2-00.permall).
4. Trigger domain startup: Wait for or trigger the root-level libvirt daemon to start (or restart) the associated QEMU domain, causing virFileChownFiles() to be called on the swtpm state directory.
5. Achieve file ownership change: The libvirt daemon follows the symlink and executes chown tss <target_file>, transferring ownership of the arbitrary target file to the swtpm user.
6. Escalate privileges: With ownership of a sensitive file (e.g., /etc/shadow), modify it to enable root login or further privilege escalation (Red Hat Bugzilla, Red Hat CVE).

• File System: Unexpected symbolic links within /var/lib/libvirt/swtpm/<domain-uuid>/ directories pointing to files outside the swtpm state directory; unexpected ownership changes on sensitive system files (e.g., /etc/shadow, /etc/passwd, SSH authorized_keys files) to the tss user.
• Logs: libvirt daemon logs (/var/log/libvirt/libvirtd.log) showing chown operations on files outside the expected swtpm state directory; audit logs (/var/log/audit/audit.log) recording chown syscalls by the libvirt daemon on unexpected file paths.
• Process: Unusual file creation activity by the tss user within swtpm state directories; unexpected access to sensitive files by the tss user account after domain startup events.

The upstream fix replaces stat()/chown() with lstat()/lchown() in virFileChownFiles() and is available at the libvirt upstream commit 801160fd414ca2cc402bc01ead09b7ed4c3b8f5b. Users should apply the patched libvirt package once available from their distribution. As a workaround, if virtual TPM (vTPM) functionality is not required, remove the <tpm> device definition from the domain XML configuration to prevent the vulnerable code path from being reached — this can be verified with virsh dumpxml <domain> | grep -A5 '<tpm>'. Domains that require vTPM cannot use this workaround and should prioritize applying the upstream fix. Additionally, restrict write access to the swtpm state directory to limit the ability to plant malicious symlinks (Red Hat CVE, Red Hat Bugzilla).

Red Hat acknowledged the vulnerability and credited HE WEI (gikaku) for reporting the issue. The vulnerability was noted on Mastodon by security news accounts shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been observed at this time (Red Hat CVE).