CVE-2026-77159

MediumCVSS 5.5/10Last modified Sep 16, 2026

Description

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-61

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 11, 2026
Last modified: Sep 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-77166.3A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the f CVE-2026-771616.5The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions CVE-2026-771646.2Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, CVE-2026-771656.5File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of CVE-2026-771662.4The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar CVE-2026-771696.5A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only deleg CVE-2026-77178.8A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issue affects the function UploadCustomModule of the file /cgi-b CVE-2026-771704.3The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the CVE-2026-771768.1A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host op CVE-2026-771779.8Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prom CVE-2026-771789.1Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp CVE-2026-771799.4On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path.