The vulnerability allows a guest with root-equivalent privileges to bypass the virtio‑fs client and issue raw FUSE requests to the host's virtiofsd. A specially crafted FUSE_SYMLINK request can create an absolute symlink outside the shared directory, enabling the guest to place root‑owned symlinks in critical host locations such as /etc/cron.d. By pointing such a symlink to a payload accessible from the guest, the host's cron daemon executes it with host root privileges, effectively breaching the isolation boundary and granting the attacker full control of the host system.

The flaw exists in Kata Containers versions older than 3.31.0. The affected product is Kata Containers, specifically the runtime‑rs standalone virtio‑fs implementation. Any deployment relying on guest VMs that run virtiofsd as root without sandboxing or seccomp filtering is vulnerable.

The CVSS base score is 9.2, classifying the issue as critical. The EPSS score is not available, so the projected exploitation probability cannot be assessed, but the vulnerability is catalogued as not listed in CISA KEV. Exploitation requires root-equivalent access within the guest, which is a common privilege in a Kata VM, and a configuration that runs virtiofsd with --sandbox none and --seccomp none. If an attacker can achieve these conditions, they can readily elevate to host‑root privileges and execute arbitrary code by manipulating cron or other privileged services.