CVE-2025-14525: 
Wolfi vulnerability analysis and mitigation

CVE-2025-14525 is a denial-of-service vulnerability in KubeVirt, titled "KubeVirt Guest Agent DoS via Excessive Network Interface Reports." A low-privileged user inside a virtual machine (VM) with an active guest agent can cause the agent to report an excessive number of network interfaces, overwhelming etcd's object storage capacity and blocking Virtual Machine Instance (VMI) configuration updates. This effectively prevents VM administrators from managing the affected VM. The vulnerability affects KubeVirt versions up to and including 1.7.0 (Go module kubevirt.io/kubevirt). It was reported on December 11, 2025, and publicly disclosed on January 26, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): KubeVirt's guest agent collects and reports all network interfaces found within the guest OS without imposing any upper bound on the number of interfaces reported. When a malicious or compromised VM user creates an excessive number of virtual network interfaces inside the guest, the guest agent faithfully reports all of them to the KubeVirt control plane. This data is stored in etcd as part of the VMI object; if the reported interface data is large enough to approach or exceed etcd's per-object size limit, subsequent updates to the VMI object are blocked. The attack requires only low privileges (access to a guest VM with an active guest agent) and no user interaction, and its scope is changed because the impact crosses from the guest VM into the administrative control plane (Github Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial of service for VM administrative operations: the VM administrator loses the ability to apply configuration changes to the affected VMI (e.g., changing network link state, updating resource allocations). There is no confidentiality impact, and integrity impact is limited to the low-level disruption of VMI state management. The scope is marked as "Changed" because the attack originates inside a guest VM but affects the broader KubeVirt control plane and etcd storage layer, potentially disrupting management of other VMs sharing the same infrastructure (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013–0.029%, placing it in a low percentile for near-term exploitation likelihood (Github Advisory). Exploitation requires low-privilege access to a guest VM with the KubeVirt guest agent enabled, limiting the attacker pool to users with existing VM access.

1. Gain VM access: Obtain low-privileged access to a guest VM running under KubeVirt with the QEMU guest agent (or equivalent KubeVirt guest agent) active.
2. Create excessive virtual network interfaces: Inside the guest OS, use standard OS tools (e.g., ip link add, scripted loop) to create a large number of virtual network interfaces (e.g., dummy or loopback interfaces) sufficient to generate a guest agent report that approaches or exceeds etcd's per-object size limit.
3. Trigger guest agent reporting: The KubeVirt guest agent periodically polls and reports all detected network interfaces to the KubeVirt control plane. With enough interfaces created, the reported data bloats the VMI object stored in etcd.
4. Block VMI updates: Once the VMI object in etcd reaches its size limit, any attempt by the VM administrator to update the VMI configuration (e.g., changing network link state, modifying resource settings) will be rejected, achieving denial of service for administrative operations (Red Hat Bugzilla, Github Advisory).

• Logs: KubeVirt controller or virt-handler logs showing repeated etcd write failures or "object too large" errors when attempting to update a VMI object; guest agent logs reporting an abnormally high number of network interfaces for a single VM.
• Kubernetes/etcd: VMI objects in etcd approaching or exceeding the maximum object size limit (default 1.5 MB); kubectl describe vmi <name> showing stale or unupdatable status.
• Process/Guest: Unusually high number of network interfaces inside a guest VM (e.g., dozens to hundreds of dummy interfaces visible via ip link show); unexpected scripted interface creation activity in guest OS process logs.
• Network: No direct network-layer IOCs, as the attack is internal to the guest OS and KubeVirt control plane communication.

The GitHub Advisory lists KubeVirt versions up to and including 1.7.0 as affected, with no patched version explicitly listed in the advisory at time of publication (Github Advisory). Organizations should monitor the KubeVirt releases page for a patched version and apply it promptly. As interim mitigations: restrict which users have access to guest VMs with the guest agent enabled, implement monitoring for abnormal numbers of network interfaces reported by the guest agent, and consider disabling the guest agent on VMs where it is not strictly required. Access controls limiting VM user capabilities within the guest OS can also reduce exploitation risk (Feedly).

Red Hat assigned and disclosed this CVE through its Product Security team, with the bug originally filed in Red Hat Bugzilla in December 2025 under embargo before public disclosure in January 2026 (Red Hat Bugzilla). The vulnerability received moderate attention from automated vulnerability tracking services (VulnDB, Vulners, CVEFeed) and was noted in the GitLab advisory database, but no significant researcher commentary or media coverage has been identified beyond standard advisory syndication (Feedly).