On a Tuesday in 2026, Daniel P. Berrangé via Devel wrote:
From: HE WEI（ギカク） <skyexpoc@gmail.com>
virFileChownFiles() selected entries with virFileIsRegular() (stat(), follows symlinks) and changed ownership with chown() (follows symlinks). A component that owns the target directory at a lower privilege (e.g. the swtpm/tss state directory) can plant a symlink to an arbitrary regular file and have the root caller chown that file. Use lstat() to skip non-regular entries and fchownat(..., AT_SYMLINK_NOFOLLOW) so a symlink final component is never followed.
Fixes: CVE-2026-63622 Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com> [DB: use g_lstat instead of stat; use lchown instead of fchownat for portability; added comment] Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- src/util/virfile.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
Reviewed-by: Ján Tomko <jtomko@redhat.com> Jano