RHSA-2026:51031HighCVSS 8.8

Red Hat Security Advisory: OpenShift Virtualization v4.22 Images

Published
August 6, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (2)

CVE-2026-13201 →CVE-2026-13622 →

📋 Description

CVE-2026-13201 — kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption CVE-2026-13622 — kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

🎯 Affected products50

  • Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/iommufd-device-plugin-rhel9@sha256:7c08c2ee2036c419a855e4e304d791715af3c07b5502556459414bd1c949142e_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/iommufd-device-plugin-rhel9@sha256:8f56dc0fec3ea355dbb8f0b28d74c1d13a125e8050a4d26f32973ca3359f42e1_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/iommufd-device-plugin-rhel9@sha256:9415f4039af25f7a18c1141ea225848c27a29c4be96377d79a6802d51a3413ff_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:61586aee58765432e294032414f7bd26460127bda0066e2a430284fd12f1ce39_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:8e784f36dde1e37d7e58b1ebf9956dfd85314a9b25b3927c5d59caf8c1e310ff_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/kubevirt-aie-webhook-rhel9@sha256:da2610f3a88acc9841eb6385e6bb4ec1cf9f3f7b9a0260a14c3e1f471f594b66_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:062e827ff80da79b9c7a243ec15836430ce9c991320ac3bd9cc07cbeee5d4a2d_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:656bf5b2df45a03ddf595496460a9d8788094edeabba94170d69f2452a31c6bf_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/libguestfs-tools-rhel9@sha256:a499387ec218cdd04b6f350b3aac0a20a71029cf9e91d1fd178e58d9b3f8dae3_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:95a731065ec755424ce773fb9c9180151fe326ded89b69cfd5b61ce54bb4f576_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:975cd1573f1a5fcdaeeb6a54715d252378ce88bf7dab5a220b6fec6276b100cc_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-cni-rhel9@sha256:d74ebabe1816d78db39afcb25c00c18e6e1bcca34c51bff36f5185d4ef3d0303_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:8a10409fd0fed5f6a49050c7b06fd0ce596547dcfe3aa827312c3b8cf779c129_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:91e5dafe47cb35d57391748b406ab2a69d5181d3cc2a3ae1d4e8dabcc45fbdd4_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9@sha256:bdc2d324a95e434bdd8fbf70d697fea2027835abd7da9add16a2971d87483d82_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:07269b4b6482d9a67c22152867b4bec6d754275be6055f479239f1ce2a852a30_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:3f121cabbd1fbc8978e8dd66159da7c5821b60611596d123990f4396ff51df7a_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/pr-helper-rhel9@sha256:f815fcf3224eb85ff350ab555b47a098c6a6463cbf92f0f2fbcc330273ee25b2_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:2c2ac2ddbd2635c843bb6b94388a863bad9f5e1f1989100e1925f1ccf1801ef5_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:8a7bcaf665eb61a4dda50e139e9bf16f857b5ae580e7cb8030e9163087d790c4_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/sidecar-shim-rhel9@sha256:ec198eb85eb649f13160a78bc0e6b1e76bb19841d264d4e29125185a7c47112a_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:03f355224327c01d370ae4fea50e663e048938265282e7f57b7275ce1616ec47_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:5e749743a6db965bdc19c2ff4bdfe624988f97c124d2a97e2891c4824e571634_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-api-rhel9@sha256:bd01434b74fc529a4c1c7eb8aeda94aa8470c9dd7b3969face8a809ead320a76_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:7301b803f19ae38e829c8b3a106f3335bac2a8ea0f97cf9671853ec47eb99d4b_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:789ae51f2ea0257082fedc6ac640fde47a44752ecfeec6ad003a44a2a02838cc_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server-rhel9@sha256:92615775b0361d6c06d4512792ee635f2560982af6de30e2b75272cc4501146d_arm64 as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:723dcb9c494d484ab292b141a87b44841713b75bc945973219b5b70ed3cee8a3_s390x as a component of Red Hat Container Native Virtualization 4.22
  • registry.redhat.io/container-native-virtualization/virt-controller-rhel9@sha256:7840dc165235ed47f17ddf5c5f026ee3a2f5c572b8828237ecd22680d2ae34df_amd64 as a component of Red Hat Container Native Virtualization 4.22
  • +20 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The following measures reduce the attacker pool and limit secondary impact: Review RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem. Ensure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels. RHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path. Note: no mitigation currently addresses the notify socket hijacking vector. The attacker's ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability. Workaround: Restrict pods/exec permissions in namespaces that run virtual machines. The pods/exec RBAC permission is required for the attack — removing it from VM operator roles prevents exploitation. Additionally, enable Kubernetes audit logging and monitor for kubectl exec commands targeting virt-launcher pods, especially during live migration events.

🔗 References (5)