A flaw in the safepath package of KubeVirt causes the kernel to follow symlinks even when called with O_NOFOLLOW. When the leaf node is a symlink, the downstream helper that uses /proc/self/fd/N dereferences it, allowing the virt-handler process to change ownership or permission bits on a file that lies on the host filesystem instead of the intended target. This weakness is a classic path traversal/relative path confusion problem (CWE‑61) that can result in corruption of host metadata, enabling privilege escalation or persistence on the host. The impact is limited to changing file host’s security state.

Red Hat OpenShift Virtualization 4 (Container Native Virtualization 4) is affected. The vulnerability exists in the KubeVirt component that runs inside the virt-handler and virt-launcher pods on this distribution.

The CVSS score of 5.2 indicates a moderate impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker must have the ability to run commands within a virt-launcher pod that can invoke the flawed safepath logic. The attack can be executed locally from the pod’s namespace and does not require external network access. The primary vector is therefore an internal privilege escalation or local compromise within a containerized environment.