A vulnerability in libvirt enables a local attacker controlling the confined swtpm user to exploit a symlink following defect in the virFileChownFiles() routine. By creating a symbolic link inside the swtpm state directory, the attacker can trick the root‑level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This grants the attacker root‑level control over file ownership, effectively a privilege escalation that permits modifications to protected files on the host. The weakness corresponds to CWE‑59, a classic directory traversal/symlink flaws scenario.

Red Hat Enterprise Linux 10, 6, 7, 8, 9, and Red Hat Enterprise Linux for NVIDIA 26 are affected when they run virtual Trusted Platform Module (vTPM) functionality.

With a CVSS score of 7.8 the issue is classified as high severity, though the EPSS score is not available so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local; the threat actor must already gain some level of access to the host to manipulate the swtpm state directory or supply a malicious domain XML. Successful exploitation allows the attacker to escape the confinement of the swtpm sandbox and gain ownership rights over arbitrary files, setting the stage for further compromise. Because the code path is specific to the vTPM mode, standard RHEL systems operating without vTPM are not impacted.