CVE-2026-77159: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-77159 is a UNIX symbolic link (symlink) following vulnerability in libvirt's qemuTPMEmulatorPrepareHost() function that allows a local attacker to cause libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user. The flaw was reported by Suraj Theekshana and disclosed on September 11, 2026, affecting Red Hat's libvirt package (including virt:rhel/libvirt). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-61 (UNIX Symbolic Link Following). In src/qemu/qemu_tpm.c, the qemuTPMEmulatorPrepareHost() function performs a path-based chown() on the swtpm logfile without first verifying that the path is not a symbolic link. Because the log directory is writable by the swtpm user, a local attacker with access to that account can replace the logfile with a symlink pointing to an arbitrary target file. When libvirtd subsequently starts a QEMU domain with an emulated TPM, it follows the symlink and transfers ownership of the target file to swtpm:swtpm, enabling the attacker to then modify that file. The upstream fix replaces the path-based chown() with open(O_NOFOLLOW) followed by fchown() on the resulting file descriptor (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a local attacker with access to the swtpm account to change the ownership of any arbitrary file on the system to the swtpm user, resulting in a high integrity impact with no confidentiality or availability impact. Once ownership of a sensitive file (e.g., a system configuration file, cron job, or privileged binary) is transferred, the attacker can modify it to escalate privileges or achieve persistent access. The scope is limited to the local system, but the ability to manipulate arbitrary file ownership makes this a meaningful local privilege escalation primitive (Red Hat CVE, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term (EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and an account with swtpm privileges, which significantly limits the attacker pool.

1. Gain swtpm account access: Obtain local access to a system running libvirt with an emulated TPM, and acquire access to the swtpm user account (e.g., through a compromised service or lateral movement).
2. Identify the swtpm log directory: Locate the swtpm log directory, which is writable by the swtpm user (typically under /var/log/swtpm/ or a libvirt-managed path).
3. Remove or rename the existing logfile: Delete or move the existing swtpm logfile to free the path for symlink placement.
4. Create a malicious symlink: Replace the logfile path with a symbolic link pointing to an arbitrary target file whose ownership the attacker wishes to change (e.g., ln -s /etc/cron.d/malicious_job /var/log/swtpm/libvirt/qemu/<domain>-swtpm.log).
5. Trigger libvirtd to start a QEMU domain with emulated TPM: Start or restart a virtual machine configured with an emulated TPM, causing libvirtd (running as root) to invoke qemuTPMEmulatorPrepareHost(), which performs chown() on the symlink path, transferring ownership of the target file to swtpm:swtpm.
6. Modify the target file: With ownership of the target file now held by swtpm, use the swtpm account to write malicious content (e.g., a cron job or sudoers entry) to achieve privilege escalation (Red Hat Bugzilla, Red Hat CVE).

• File System: Unexpected symbolic links in the swtpm log directory (e.g., /var/log/swtpm/libvirt/qemu/) pointing to files outside the expected log path; unexpected ownership changes on sensitive system files (e.g., /etc/cron.d/, /etc/sudoers.d/, or system binaries) to swtpm:swtpm.
• Logs: libvirtd or audit logs showing chown() operations on files outside the expected swtpm log directory; SELinux AVC denial messages related to swtpm_t domain attempting to create symlinks to restricted file types (if SELinux is in enforcing mode).
• Process: Unexpected file modification activity by the swtpm process on files it does not normally own; unusual swtpm process activity outside of virtual machine startup/shutdown events (Red Hat CVE, Red Hat Bugzilla).

On Red Hat Enterprise Linux, ensuring SELinux is in enforcing mode (the default) confines the swtpm process to the swtpm_t domain, which restricts symlink creation to arbitrary file types and significantly reduces the practical impact of this flaw — Red Hat explicitly recommends not disabling or setting SELinux to permissive mode as a mitigation (Red Hat CVE). The upstream fix for libvirt replaces the vulnerable path-based chown() with open(O_NOFOLLOW) + fchown() to prevent symlink following; users should apply vendor-provided patches when available via SUSE (SUSE-SU-2026:3939-1) and openSUSE security updates (Red Hat Bugzilla). Additionally, restrict write access to the swtpm log directory to only authorized accounts and monitor for unexpected symlink creation in sensitive directories.

SUSE issued a security update (SUSE-SU-2026:3939-1) addressing this vulnerability in libvirt, and openSUSE published corresponding security announcements (Linux Security). The vulnerability was also covered in the openSUSE Tumbleweed monthly update for August 2026. Community reaction has been limited given the moderate severity and local-only exploitation requirement.