{"id":"UBUNTU-CVE-2026-63622","details":"A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.","modified":"2026-09-24T02:00:50.970510855Z","published":"2026-08-10T21:17:00Z","related":["USN-8652-1"],"upstream":["CVE-2026-63622"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-63622"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-63622"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2513065"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-63622"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8652-1"}],"affected":[{"package":{"name":"libvirt","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/libvirt?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-0ubuntu8.20+esm1"}]}],"versions":["5.4.0-0ubuntu5","6.0.0-0ubuntu1","6.0.0-0ubuntu2","6.0.0-0ubuntu3","6.0.0-0ubuntu4","6.0.0-0ubuntu5","6.0.0-0ubuntu6","6.0.0-0ubuntu7","6.0.0-0ubuntu8","6.0.0-0ubuntu8.1","6.0.0-0ubuntu8.2","6.0.0-0ubuntu8.3","6.0.0-0ubuntu8.4","6.0.0-0ubuntu8.5","6.0.0-0ubuntu8.7","6.0.0-0ubuntu8.8","6.0.0-0ubuntu8.9","6.0.0-0ubuntu8.10","6.0.0-0ubuntu8.11","6.0.0-0ubuntu8.12","6.0.0-0ubuntu8.13","6.0.0-0ubuntu8.14","6.0.0-0ubuntu8.15","6.0.0-0ubuntu8.16","6.0.0-0ubuntu8.19","6.0.0-0ubuntu8.20"],"ecosystem_specific":{"binaries":[{"binary_name":"libnss-libvirt","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_name":"libvirt-clients","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_name":"libvirt-daemon","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_version":"6.0.0-0ubuntu8.20+esm1","binary_name":"libvirt-daemon-driver-lxc"},{"binary_name":"libvirt-daemon-driver-qemu","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_name":"libvirt-daemon-driver-storage-gluster","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_name":"libvirt-daemon-driver-storage-rbd","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_version":"6.0.0-0ubuntu8.20+esm1","binary_name":"libvirt-daemon-driver-storage-zfs"},{"binary_name":"libvirt-daemon-driver-vbox","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_name":"libvirt-daemon-driver-xen","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_name":"libvirt-daemon-system","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_name":"libvirt-daemon-system-systemd","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_name":"libvirt-daemon-system-sysv","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_name":"libvirt-sanlock","binary_version":"6.0.0-0ubuntu8.20+esm1"},{"binary_version":"6.0.0-0ubuntu8.20+esm1","binary_name":"libvirt-wireshark"},{"binary_name":"libvirt0","binary_version":"6.0.0-0ubuntu8.20+esm1"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63622.json"}},{"package":{"name":"libvirt","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libvirt?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-1ubuntu7.19"}]}],"versions":["7.6.0-0ubuntu1","7.6.0-0ubuntu3","8.0.0-1ubuntu3","8.0.0-1ubuntu4","8.0.0-1ubuntu5","8.0.0-1ubuntu6","8.0.0-1ubuntu7","8.0.0-1ubuntu7.1","8.0.0-1ubuntu7.2","8.0.0-1ubuntu7.3","8.0.0-1ubuntu7.4","8.0.0-1ubuntu7.5","8.0.0-1ubuntu7.6","8.0.0-1ubuntu7.7","8.0.0-1ubuntu7.8","8.0.0-1ubuntu7.9","8.0.0-1ubuntu7.10","8.0.0-1ubuntu7.11","8.0.0-1ubuntu7.12","8.0.0-1ubuntu7.13","8.0.0-1ubuntu7.14","8.0.0-1ubuntu7.15","8.0.0-1ubuntu7.16","8.0.0-1ubuntu7.17","8.0.0-1ubuntu7.18"],"ecosystem_specific":{"binaries":[{"binary_name":"libnss-libvirt","binary_version":"8.0.0-1ubuntu7.19"},{"binary_version":"8.0.0-1ubuntu7.19","binary_name":"libvirt-clients"},{"binary_name":"libvirt-daemon","binary_version":"8.0.0-1ubuntu7.19"},{"binary_version":"8.0.0-1ubuntu7.19","binary_name":"libvirt-daemon-config-network"},{"binary_name":"libvirt-daemon-config-nwfilter","binary_version":"8.0.0-1ubuntu7.19"},{"binary_name":"libvirt-daemon-driver-lxc","binary_version":"8.0.0-1ubuntu7.19"},{"binary_name":"libvirt-daemon-driver-qemu","binary_version":"8.0.0-1ubuntu7.19"},{"binary_name":"libvirt-daemon-driver-storage-gluster","binary_version":"8.0.0-1ubuntu7.19"},{"binary_name":"libvirt-daemon-driver-storage-iscsi-direct","binary_version":"8.0.0-1ubuntu7.19"},{"binary_version":"8.0.0-1ubuntu7.19","binary_name":"libvirt-daemon-driver-storage-rbd"},{"binary_name":"libvirt-daemon-driver-storage-zfs","binary_version":"8.0.0-1ubuntu7.19"},{"binary_version":"8.0.0-1ubuntu7.19","binary_name":"libvirt-daemon-driver-vbox"},{"binary_version":"8.0.0-1ubuntu7.19","binary_name":"libvirt-daemon-driver-xen"},{"binary_version":"8.0.0-1ubuntu7.19","binary_name":"libvirt-daemon-system"},{"binary_name":"libvirt-daemon-system-systemd","binary_version":"8.0.0-1ubuntu7.19"},{"binary_name":"libvirt-daemon-system-sysv","binary_version":"8.0.0-1ubuntu7.19"},{"binary_name":"libvirt-login-shell","binary_version":"8.0.0-1ubuntu7.19"},{"binary_name":"libvirt-sanlock","binary_version":"8.0.0-1ubuntu7.19"},{"binary_name":"libvirt-wireshark","binary_version":"8.0.0-1ubuntu7.19"},{"binary_name":"libvirt0","binary_version":"8.0.0-1ubuntu7.19"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63622.json"}},{"package":{"name":"libvirt","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libvirt?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-2ubuntu8.16"}]}],"versions":["9.6.0-1ubuntu1","9.6.0-1ubuntu2","10.0.0-1ubuntu1","10.0.0-2ubuntu1","10.0.0-2ubuntu5","10.0.0-2ubuntu7","10.0.0-2ubuntu8","10.0.0-2ubuntu8.1","10.0.0-2ubuntu8.2","10.0.0-2ubuntu8.3","10.0.0-2ubuntu8.4","10.0.0-2ubuntu8.5","10.0.0-2ubuntu8.6","10.0.0-2ubuntu8.7","10.0.0-2ubuntu8.8","10.0.0-2ubuntu8.9","10.0.0-2ubuntu8.10","10.0.0-2ubuntu8.11","10.0.0-2ubuntu8.12","10.0.0-2ubuntu8.13","10.0.0-2ubuntu8.14","10.0.0-2ubuntu8.15"],"ecosystem_specific":{"binaries":[{"binary_name":"libnss-libvirt","binary_version":"10.0.0-2ubuntu8.16"},{"binary_name":"libvirt-clients","binary_version":"10.0.0-2ubuntu8.16"},{"binary_version":"10.0.0-2ubuntu8.16","binary_name":"libvirt-clients-qemu"},{"binary_name":"libvirt-daemon","binary_version":"10.0.0-2ubuntu8.16"},{"binary_name":"libvirt-daemon-config-network","binary_version":"10.0.0-2ubuntu8.16"},{"binary_name":"libvirt-daemon-config-nwfilter","binary_version":"10.0.0-2ubuntu8.16"},{"binary_version":"10.0.0-2ubuntu8.16","binary_name":"libvirt-daemon-driver-lxc"},{"binary_name":"libvirt-daemon-driver-qemu","binary_version":"10.0.0-2ubuntu8.16"},{"binary_name":"libvirt-daemon-driver-storage-gluster","binary_version":"10.0.0-2ubuntu8.16"},{"binary_name":"libvirt-daemon-driver-storage-iscsi-direct","binary_version":"10.0.0-2ubuntu8.16"},{"binary_name":"libvirt-daemon-driver-storage-rbd","binary_version":"10.0.0-2ubuntu8.16"},{"binary_version":"10.0.0-2ubuntu8.16","binary_name":"libvirt-daemon-driver-storage-zfs"},{"binary_name":"libvirt-daemon-driver-vbox","binary_version":"10.0.0-2ubuntu8.16"},{"binary_name":"libvirt-daemon-driver-xen","binary_version":"10.0.0-2ubuntu8.16"},{"binary_version":"10.0.0-2ubuntu8.16","binary_name":"libvirt-daemon-system"},{"binary_name":"libvirt-daemon-system-systemd","binary_version":"10.0.0-2ubuntu8.16"},{"binary_version":"10.0.0-2ubuntu8.16","binary_name":"libvirt-daemon-system-sysv"},{"binary_name":"libvirt-l10n","binary_version":"10.0.0-2ubuntu8.16"},{"binary_name":"libvirt-login-shell","binary_version":"10.0.0-2ubuntu8.16"},{"binary_name":"libvirt-sanlock","binary_version":"10.0.0-2ubuntu8.16"},{"binary_version":"10.0.0-2ubuntu8.16","binary_name":"libvirt-wireshark"},{"binary_version":"10.0.0-2ubuntu8.16","binary_name":"libvirt0"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63622.json"}},{"package":{"name":"libvirt","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libvirt?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.3"}]}],"versions":["11.6.0-1ubuntu3","11.6.0-1ubuntu5","11.6.0-1ubuntu6","11.6.0-1ubuntu7","11.6.0-1ubuntu8","12.0.0-1ubuntu3","12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libnss-libvirt"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-clients"},{"binary_name":"libvirt-clients-qemu","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-common"},{"binary_name":"libvirt-daemon","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-common"},{"binary_name":"libvirt-daemon-config-network","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-config-nwfilter"},{"binary_name":"libvirt-daemon-driver-interface","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-driver-lxc"},{"binary_name":"libvirt-daemon-driver-network","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-nodedev","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-nwfilter","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-qemu","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-secret","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-disk","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-gluster","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-iscsi","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-iscsi-direct","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-logical","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-mpath","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-rbd","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-driver-storage-scsi"},{"binary_name":"libvirt-daemon-driver-storage-zfs","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-driver-vbox"},{"binary_name":"libvirt-daemon-driver-xen","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-lock","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-log","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-plugin-lockd"},{"binary_name":"libvirt-daemon-plugin-sanlock","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-system","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-system-systemd"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-system-sysv"},{"binary_name":"libvirt-l10n","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-login-shell","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-sanlock"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-ssh-proxy"},{"binary_name":"libvirt-wireshark","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt0"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63622.json"}},{"package":{"name":"libvirt-hwe","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libvirt-hwe?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2","12.0.0-1ubuntu5.3"],"ecosystem_specific":{"binaries":[{"binary_name":"libnss-libvirt-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-clients-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-clients-qemu-hwe"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-common-hwe"},{"binary_name":"libvirt-daemon-common-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-config-network-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-config-nwfilter-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-interface-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-lxc-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-driver-network-hwe"},{"binary_name":"libvirt-daemon-driver-nodedev-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-nwfilter-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-driver-qemu-hwe"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-driver-secret-hwe"},{"binary_name":"libvirt-daemon-driver-storage-disk-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-gluster-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-driver-storage-iscsi-direct-hwe"},{"binary_name":"libvirt-daemon-driver-storage-iscsi-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-logical-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-mpath-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-driver-storage-rbd-hwe"},{"binary_name":"libvirt-daemon-driver-storage-scsi-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-driver-storage-zfs-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-driver-vbox-hwe"},{"binary_name":"libvirt-daemon-driver-xen-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-lock-hwe"},{"binary_name":"libvirt-daemon-log-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-plugin-lockd-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-plugin-sanlock-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-daemon-system-hwe"},{"binary_name":"libvirt-daemon-system-systemd-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-daemon-system-sysv-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-dev-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-doc-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-l10n-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-login-shell-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-sanlock-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_name":"libvirt-ssh-proxy-hwe","binary_version":"12.0.0-1ubuntu5.3"},{"binary_version":"12.0.0-1ubuntu5.3","binary_name":"libvirt-wireshark-hwe"},{"binary_name":"libvirt0-hwe","binary_version":"12.0.0-1ubuntu5.3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63622.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}