CVE-2026-53657: Lima privilege escalation via guest agent socket in QEMU VMs

Executive brief

Lima is a lightweight VM manager for macOS and Linux that allows users to run Linux workloads in virtual machines. When using the QEMU driver with the guest agent enabled, an arbitrary unprivileged user inside the VM could access the guest agent socket and execute arbitrary commands with root privileges within the VM. The vulnerability does not affect the host system, only the guest VM.

Technical details

The vulnerability is a permission issue (CWE-276, CWE-668) in Lima's guest agent implementation. When the guest agent is enabled on QEMU-based VMs, the `/run/lima-guestagent.sock` Unix socket is created with overly permissive file permissions, allowing arbitrary VM users to access it. The socket provides tunneling service to privileged daemons like D-Bus, allowing an attacker to execute commands with root privileges within the VM. Attack precondition is user access to the guest VM; no network access or authentication is required. The vulnerability is specific to the QEMU driver; the VZ driver uses vsocks which are not affected. Lima v2.1.3 patches this issue by restricting socket permissions. Workarounds include switching to the VZ driver or disabling the guest agent entirely.

Affected products

• lima-vm Lima <= 2.1.2

Timeline

• 2026-06-19: disclosed
• 2026-06-19: patched: Lima v2.1.3 released with patch commit 8a45892378d22f40505c31a38f786a07701b6d50
• 2026-08-14: advisory: GitHub Advisory Database publication

References

• https://api.github.com/users/misop00p
• https://github.com/misop00p
• https://api.github.com/users/misop00p/gists%7B/gist_id%7D
• https://api.github.com/users/misop00p/repos
• https://avatars.githubusercontent.com/u/81009676?v=4
• https://api.github.com/users/misop00p/events%7B/privacy%7D