CVE-2026-12080: 
QEMU vulnerability analysis and mitigation

CVE-2026-12080 is a local privilege escalation vulnerability in the QEMU Guest Agent (qga) affecting the guest-ssh-add-authorized-keys command handler. A local unprivileged user can exploit symbolic link manipulation — either via a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race — to gain ownership of arbitrary root-owned files or directories, ultimately achieving root access. The vulnerability affects Red Hat's qemu-kvm packages across multiple RHEL versions and RHCOS, and requires an external management layer such as libvirt to trigger the affected code path. It was disclosed on July 9, 2026, with NVD publication on July 20, 2026, and carries a CVSS v3.1 base score of 7.3 (High) (Red Hat CVE, GitHub Advisory).

The root cause is improper symbolic link resolution before file access (CWE-61: UNIX Symbolic Link Following). When qmp_guest_ssh_add_authorized_keys adds an SSH key for an existing local user, the QEMU Guest Agent (running as root) checks whether the user's .ssh directory exists using a symlink-following directory test, then writes and chowns the authorized_keys file using a plain chown rather than lchown. A local user who controls their home directory can pre-stage .ssh or authorized_keys as a symbolic link pointing to an arbitrary root-owned file or directory; when a host operator or libvirt triggers a key-add operation for that user, the root agent follows the link and transfers ownership of the target to the unprivileged user, who can then overwrite it to obtain root. An upstream patch was submitted to the QEMU mailing list and is tracked at the QEMU project issue tracker (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation grants the attacker full root-level access on the guest virtual machine, resulting in high confidentiality, integrity, and availability impact. An attacker can overwrite critical system files (e.g., /etc/passwd, /etc/sudoers, SSH host keys) after gaining ownership, enabling persistent backdoors, credential theft, or complete system takeover. Because the vulnerability operates within the guest OS, the immediate blast radius is confined to the affected VM, though a compromised guest could serve as a pivot point for further attacks against the hypervisor environment or adjacent systems (Red Hat CVE, Red Hat Bugzilla).

1. Gain local unprivileged access: Obtain a shell on the target guest VM as a low-privileged user who owns their home directory (e.g., via SSH with a standard user account).
2. Pre-stage the symlink: Before any SSH key management operation is triggered, replace the user's ~/.ssh directory or ~/.ssh/authorized_keys file with a symbolic link pointing to a target root-owned file or directory (e.g., ln -s /etc/sudoers ~/.ssh/authorized_keys or ln -s /etc/cron.d ~/.ssh).
3. Trigger the vulnerable code path: Wait for or socially engineer an operator/administrator to trigger a guest-ssh-add-authorized-keys operation via libvirt or another management layer (e.g., virsh set-user-sshkeys <domain> <user> <pubkey>).
4. Exploit symlink follow: The QEMU Guest Agent (running as root) follows the symlink and executes chown on the symlink target, transferring ownership of the root-owned file or directory to the unprivileged user.
5. Achieve root access: With ownership of the target file (e.g., /etc/sudoers), overwrite it to grant the unprivileged user passwordless sudo access, then execute sudo su to obtain a root shell (Red Hat Bugzilla, GitHub Advisory).

• File System: Unexpected symbolic links in user home directories pointing to system files (e.g., ~/.ssh or ~/.ssh/authorized_keys resolving outside the user's home directory); unexpected ownership changes on critical system files such as /etc/sudoers, /etc/passwd, /etc/cron.d, or SSH host key files.
• Logs: QEMU Guest Agent logs (/var/log/qemu-ga.log) showing guest-ssh-add-authorized-keys operations followed by chown calls on unexpected paths; auditd records of chown/fchown syscalls by the qemu-ga process on files outside user home directories.
• Process: Unexpected privilege escalation events (e.g., sudo usage by previously non-privileged accounts); new entries in /etc/sudoers or /etc/sudoers.d/ not matching known configuration; unexpected modifications to /etc/passwd or /etc/shadow.
• Network: Outbound SSH connections from the guest VM to external hosts using newly added authorized keys not provisioned through normal channels.

An upstream patch has been submitted to the QEMU mailing list (https://lists.gnu.org/archive/html/qemu-devel/2026-07/msg02717.html) and is tracked in the QEMU project issue tracker. Red Hat has acknowledged affected products including qemu-kvm on RHEL 8, RHEL 9, RHEL 10, and RHCOS; users should monitor Red Hat advisories for updated qemu-kvm packages and apply them as soon as they become available. As an interim workaround, restrict or disable the guest-ssh-add-authorized-keys QGA command via libvirt's qemu:commandline or equivalent policy controls, and limit which management accounts can trigger SSH key provisioning operations on guest VMs (Red Hat CVE, Red Hat Bugzilla).

A Mastodon post referencing the vulnerability was noted shortly after NVD publication on July 20, 2026, indicating early community awareness. The vulnerability was reported and tracked internally by Red Hat's Product Security team (OSIDB) and assigned high severity in Red Hat Bugzilla. No major vendor statements beyond Red Hat's CVE page or significant media coverage have been identified at this time (Red Hat CVE, Red Hat Bugzilla).