Executive brief
A security flaw has been identified in the QEMU Guest Agent, a background service used to manage virtual machines from a host server. A local user on a virtual machine could trick the system into changing the ownership of sensitive system files by using symbolic links. If successful, this allows a standard user to gain full administrative (root) control over the virtual machine, potentially leading to data theft or system disruption.
Technical details
A flaw exists in the 'guest-ssh-add-authorized-keys' command handler of the QEMU Guest Agent (qga). The root-privileged agent performs directory checks that follow symbolic links and uses 'chown' instead of 'lchown' when managing a user's .ssh directory and authorized_keys file. A local unprivileged user can exploit this via a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) race condition. By pre-staging these paths as symlinks, the attacker can force the agent to transfer ownership of arbitrary root-owned files to the attacker's account. This requires an external management layer like libvirt to trigger the affected code path.
Affected products
- QEMU QEMU Guest Agent unspecified
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat OpenShift Container Platform 4 affected
Timeline
- 2026-07-13: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-20: advisory: NVD publication date