RHSA-2026:80941MediumCVSS 7.3

Red Hat Security Advisory: OpenShift Virtualization v4.12 Images

Published
October 12, 2026
Last Modified
October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-13201 →

📋 Description

CVE-2026-13201 — kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level VM disruption

🎯 Affected products10

  • Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/libguestfs-tools@sha256:c5e5c9aab74f7e8bad617472230e05468e610674404813ce309c23c7c307648f_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-api@sha256:ae755f6d3a0d6bd13f71927baa6e29557778618cb3dc772a5f5e7ff816335716_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-artifacts-server@sha256:1e24f06dd80cc3f9ed717fa4144f324789639ae0009f16a4066aff4d362742ec_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-controller@sha256:d43676ce61e8587ab899d6831df379eede1d36760261121774582bdbab000cb6_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-exportproxy@sha256:694f608bc37718bd6e0b5af22cb0e2854676cfbb32eec49805610124a859411d_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-exportserver@sha256:cc4fcc3f7a8c844b3ceb50ae8d54d281d635dc4b903639a1401b1b77cebd9928_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-handler@sha256:8013e94e4dfd6e5d99666e15cf7e5e3a49021bf02f6ec5f8673493972aee2cb6_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-launcher@sha256:a50816dd6d785324763fcf25c38e94c120bc832f12c24bad35887e79fe3757c4_amd64 as a component of Red Hat Container Native Virtualization 4.12
  • registry.redhat.io/container-native-virtualization/virt-operator@sha256:86a0bca4878cdabb6791e88086ee78af942aff536bd403b2a992f8654a7cfb8c_amd64 as a component of Red Hat Container Native Virtualization 4.12

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The following measures reduce the attacker pool and limit secondary impact: Review RBAC policies to restrict pods/exec permissions on virt-launcher pods to only those users who strictly require it. This reduces the number of identities that can place symlinks in the launcher filesystem. Ensure SELinux is in enforcing mode (default in OpenShift). While SELinux does not prevent the notify socket hijacking path, it restricts the set of host files targetable through the chown/chmod path by blocking operations on files with protected security labels. RHCOS immutable filesystem layers prevent modification of core OS files through the chown/chmod path. Note: no mitigation currently addresses the notify socket hijacking vector. The attacker's ability to inject domain events into virt-handler is not constrained by SELinux or filesystem immutability.

🔗 References (4)