Every CVESearch/Get API key

CVE-2026-12080

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

7.3 HighPublic exploitFix available

CVE-2026-12080 is a high vulnerability (CVSS 7.3) in Red Hat Enterprise Linux 10, published July 14, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in qemu-guest-agent 17:10.1.0-17.el9_8.9.alma.1.

What does this mean?
Severity
7.3 HighCVSS 3.1, CVE List
Exploit chance
0.14%EPSS, 3rd percentile
Exploitation
None known1 public exploit
Fixed in
17:10.1.0-17.el9_8.9.alma.1qemu-guest-agent +83 more

Description

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.14%Unchanged since Jul 21, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu-guest-agent
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-img
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-audio-pa
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-block-blkio
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-block-curl
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-block-rbd
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-common
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-core
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-device-display-virtio-gpu
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
Show 74 moreShow less
Affected packages
PackageAffectedFixed
qemu-kvm-device-display-virtio-gpu-ccw
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-device-display-virtio-gpu-pci
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-device-display-virtio-vga
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-device-usb-host
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-device-usb-redirect
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-docs
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-tools
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-ui-egl-headless
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-kvm-ui-opengl
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu-pr-helper
AlmaLinux:9
before 17:10.1.0-17.el9_8.9.alma.1
17:10.1.0-17.el9_8.9.alma.1
qemu
Azure Linux:3
through 10.1.0-2None known
qemu
Alpaquita:23
7.1.0-r4 up to 9.0.4-r5
9.0.4-r5
qemu
Alpaquita:25
10.0.0-r1 up to 10.0.15-r0
10.0.15-r0
qemu
Debian:12
All versions, plus listed versions
1:10.0.0+ds-11:10.0.0+ds-21:10.0.0+ds-2~bpo12+11:10.0.0+ds-2~bpo12+21:10.0.0~rc0+ds-1
Show 45 moreShow less
1:10.0.0~rc0+ds-21:10.0.0~rc1+ds-11:10.0.0~rc1+ds-21:10.0.0~rc2+ds-11:10.0.0~rc2+ds-21:10.0.0~rc3+ds-11:10.0.0~rc3+ds-21:10.0.2+ds-11:10.0.2+ds-21:10.0.2+ds-2~bpo12+11:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-2
None known
qemu
Debian:13
All versions, plus listed versions
1:10.0.10+ds-0+deb13u11:10.0.11+ds-0+deb13u11:10.0.13+ds-0+deb13u11:10.0.2+ds-21:10.0.2+ds-2+deb13u1
Show 45 moreShow less
1:10.0.2+ds-2+deb13u1~bpo12+11:10.0.3+ds-0+deb13u11:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.0.6+ds-0+deb13u11:10.0.6+ds-0+deb13u21:10.0.7+ds-0+deb13u11:10.0.8+ds-0+deb13u11:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-21:11.0.0~rc1+ds-11:11.0.0~rc1+ds-21:11.0.0~rc1+ds-31:11.0.0~rc2+ds-1
None known
qemu
Debian:14
before 1:11.1.2+ds-1, plus listed versions
1:10.0.2+ds-21:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-4
Show 45 moreShow less
1:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-21:11.0.0~rc1+ds-11:11.0.0~rc1+ds-21:11.0.0~rc1+ds-31:11.0.0~rc2+ds-11:11.0.0~rc2+ds-21:11.0.0~rc3+ds-11:11.0.1+ds-11:11.0.2+ds-11:11.0.2+ds-21:11.0.2+ds-2~bpo13+11:11.0.3+ds-11:11.0.3+ds-21:11.1.0+ds-11:11.1.0+ds-2
1:11.1.2+ds-1
qemu
openEuler:24.03-LTS-SP4
before 8.2.0-89.oe2403sp4
8.2.0-89.oe2403sp4
qemu
openEuler:22.03-LTS-SP4
before 6.2.0-120.oe2203sp4
6.2.0-120.oe2203sp4
qemu
openEuler:24.03-LTS-SP1
before 8.2.0-62.oe2403sp1
8.2.0-62.oe2403sp1
qemu
openEuler:24.03-LTS-SP3
before 8.2.0-93.oe2403sp3
8.2.0-93.oe2403sp3
qemu-guest-agent
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-guest-agent-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-img
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-img-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-audio-dbus-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-audio-pa
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-audio-pa-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-block-blkio
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-block-blkio-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-block-curl
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-block-curl-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-block-rbd
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-block-rbd-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-common
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-common-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-core
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-core-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-debugsource
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-display-virtio-gpu
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-display-virtio-gpu-ccw
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-display-virtio-gpu-ccw-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-display-virtio-gpu-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-display-virtio-gpu-pci
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-display-virtio-gpu-pci-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-display-virtio-vga
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-display-virtio-vga-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-usb-host
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-usb-host-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-usb-redirect
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-device-usb-redirect-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-docs
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-tools
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-tools-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-ui-dbus-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-ui-egl-headless
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-ui-egl-headless-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-ui-opengl
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm-ui-opengl-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-pr-helper
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-pr-helper-debuginfo
Red Hat:enterprise_linux:9::appstream
before 17:10.1.0-17.el9_8.9
17:10.1.0-17.el9_8.9
qemu-kvm
Rocky Linux:9
before 7:10.1.0-17.el9_8.9
7:10.1.0-17.el9_8.9
qemu
Ubuntu:Pro:14.04:LTS
All versions, plus listed versions
1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3
Show 45 moreShow less
1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu32.0.0~rc1+dfsg-0ubuntu3.12.0.0+dfsg-2ubuntu12.0.0+dfsg-2ubuntu1.12.0.0+dfsg-2ubuntu1.22.0.0+dfsg-2ubuntu1.32.0.0+dfsg-2ubuntu1.52.0.0+dfsg-2ubuntu1.62.0.0+dfsg-2ubuntu1.72.0.0+dfsg-2ubuntu1.82.0.0+dfsg-2ubuntu1.92.0.0+dfsg-2ubuntu1.102.0.0+dfsg-2ubuntu1.112.0.0+dfsg-2ubuntu1.132.0.0+dfsg-2ubuntu1.142.0.0+dfsg-2ubuntu1.152.0.0+dfsg-2ubuntu1.162.0.0+dfsg-2ubuntu1.172.0.0+dfsg-2ubuntu1.182.0.0+dfsg-2ubuntu1.192.0.0+dfsg-2ubuntu1.202.0.0+dfsg-2ubuntu1.212.0.0+dfsg-2ubuntu1.222.0.0+dfsg-2ubuntu1.242.0.0+dfsg-2ubuntu1.252.0.0+dfsg-2ubuntu1.26
None known
qemu
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
1:2.3+dfsg-5ubuntu91:2.3+dfsg-5ubuntu101:2.4+dfsg-4ubuntu11:2.4+dfsg-4ubuntu21:2.4+dfsg-4ubuntu3
Show 45 moreShow less
1:2.4+dfsg-5ubuntu31:2.5+dfsg-1ubuntu21:2.5+dfsg-1ubuntu31:2.5+dfsg-1ubuntu41:2.5+dfsg-1ubuntu51:2.5+dfsg-5ubuntu11:2.5+dfsg-5ubuntu21:2.5+dfsg-5ubuntu41:2.5+dfsg-5ubuntu61:2.5+dfsg-5ubuntu71:2.5+dfsg-5ubuntu101:2.5+dfsg-5ubuntu10.11:2.5+dfsg-5ubuntu10.21:2.5+dfsg-5ubuntu10.31:2.5+dfsg-5ubuntu10.41:2.5+dfsg-5ubuntu10.51:2.5+dfsg-5ubuntu10.61:2.5+dfsg-5ubuntu10.71:2.5+dfsg-5ubuntu10.81:2.5+dfsg-5ubuntu10.91:2.5+dfsg-5ubuntu10.101:2.5+dfsg-5ubuntu10.111:2.5+dfsg-5ubuntu10.131:2.5+dfsg-5ubuntu10.141:2.5+dfsg-5ubuntu10.151:2.5+dfsg-5ubuntu10.161:2.5+dfsg-5ubuntu10.201:2.5+dfsg-5ubuntu10.211:2.5+dfsg-5ubuntu10.221:2.5+dfsg-5ubuntu10.241:2.5+dfsg-5ubuntu10.251:2.5+dfsg-5ubuntu10.261:2.5+dfsg-5ubuntu10.281:2.5+dfsg-5ubuntu10.291:2.5+dfsg-5ubuntu10.301:2.5+dfsg-5ubuntu10.311:2.5+dfsg-5ubuntu10.321:2.5+dfsg-5ubuntu10.331:2.5+dfsg-5ubuntu10.341:2.5+dfsg-5ubuntu10.351:2.5+dfsg-5ubuntu10.361:2.5+dfsg-5ubuntu10.371:2.5+dfsg-5ubuntu10.381:2.5+dfsg-5ubuntu10.391:2.5+dfsg-5ubuntu10.40
None known
qemu
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2
Show 45 moreShow less
1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.331:2.11+dfsg-1ubuntu7.341:2.11+dfsg-1ubuntu7.351:2.11+dfsg-1ubuntu7.361:2.11+dfsg-1ubuntu7.371:2.11+dfsg-1ubuntu7.381:2.11+dfsg-1ubuntu7.391:2.11+dfsg-1ubuntu7.401:2.11+dfsg-1ubuntu7.411:2.11+dfsg-1ubuntu7.421:2.11+dfsg-1ubuntu7.42+esm11:2.11+dfsg-1ubuntu7.42+esm21:2.11+dfsg-1ubuntu7.42+esm5
None known
qemu
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1
Show 35 moreShow less
1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.91:4.2-3ubuntu6.101:4.2-3ubuntu6.111:4.2-3ubuntu6.121:4.2-3ubuntu6.141:4.2-3ubuntu6.151:4.2-3ubuntu6.161:4.2-3ubuntu6.171:4.2-3ubuntu6.181:4.2-3ubuntu6.191:4.2-3ubuntu6.211:4.2-3ubuntu6.231:4.2-3ubuntu6.241:4.2-3ubuntu6.251:4.2-3ubuntu6.261:4.2-3ubuntu6.271:4.2-3ubuntu6.281:4.2-3ubuntu6.291:4.2-3ubuntu6.301:4.2-3ubuntu6.30+esm11:4.2-3ubuntu6.30+esm21:4.2-3ubuntu6.30+esm3
None known
qemu
Ubuntu:22.04:LTS
All versions, plus listed versions
1:6.0+dfsg-2expubuntu11:6.0+dfsg-2expubuntu21:6.0+dfsg-2expubuntu41:6.2+dfsg-2ubuntu51:6.2+dfsg-2ubuntu6
Show 30 moreShow less
1:6.2+dfsg-2ubuntu6.11:6.2+dfsg-2ubuntu6.21:6.2+dfsg-2ubuntu6.31:6.2+dfsg-2ubuntu6.41:6.2+dfsg-2ubuntu6.51:6.2+dfsg-2ubuntu6.61:6.2+dfsg-2ubuntu6.71:6.2+dfsg-2ubuntu6.81:6.2+dfsg-2ubuntu6.91:6.2+dfsg-2ubuntu6.101:6.2+dfsg-2ubuntu6.111:6.2+dfsg-2ubuntu6.121:6.2+dfsg-2ubuntu6.131:6.2+dfsg-2ubuntu6.141:6.2+dfsg-2ubuntu6.151:6.2+dfsg-2ubuntu6.161:6.2+dfsg-2ubuntu6.171:6.2+dfsg-2ubuntu6.181:6.2+dfsg-2ubuntu6.191:6.2+dfsg-2ubuntu6.211:6.2+dfsg-2ubuntu6.221:6.2+dfsg-2ubuntu6.231:6.2+dfsg-2ubuntu6.241:6.2+dfsg-2ubuntu6.251:6.2+dfsg-2ubuntu6.261:6.2+dfsg-2ubuntu6.271:6.2+dfsg-2ubuntu6.281:6.2+dfsg-2ubuntu6.291:6.2+dfsg-2ubuntu6.301:6.2+dfsg-2ubuntu6.31
None known
qemu
Ubuntu:24.04:LTS
All versions, plus listed versions
1:8.0.4+dfsg-1ubuntu31:8.0.4+dfsg-1ubuntu41:8.0.4+dfsg-1ubuntu51:8.1.3+ds-1ubuntu21:8.2.1+ds-1ubuntu1
Show 19 moreShow less
1:8.2.1+ds-1ubuntu81:8.2.1+ds-1ubuntu91:8.2.2+ds-0ubuntu11:8.2.2+ds-0ubuntu1.21:8.2.2+ds-0ubuntu1.41:8.2.2+ds-0ubuntu1.51:8.2.2+ds-0ubuntu1.61:8.2.2+ds-0ubuntu1.71:8.2.2+ds-0ubuntu1.81:8.2.2+ds-0ubuntu1.91:8.2.2+ds-0ubuntu1.101:8.2.2+ds-0ubuntu1.111:8.2.2+ds-0ubuntu1.121:8.2.2+ds-0ubuntu1.131:8.2.2+ds-0ubuntu1.141:8.2.2+ds-0ubuntu1.151:8.2.2+ds-0ubuntu1.161:8.2.2+ds-0ubuntu1.171:8.2.2+ds-0ubuntu1.18
None known
qemu
Ubuntu:26.10
All versions, plus listed versions
1:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu61:11.0.3+ds-2ubuntu11:11.0.3+ds-2ubuntu2
None known
qemu-hwe
Ubuntu:26.10
All versions, plus listed versions
1:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu71:10.2.1+ds-1ubuntu81:11.0.3+ds-2ubuntu21:11.0.3+ds-2ubuntu4
None known
qemu
Ubuntu:26.04:LTS
All versions, plus listed versions
1:10.1.0+ds-5ubuntu21:10.1.0+ds-5ubuntu31:10.1.0+ds-5ubuntu41:10.1.0+ds-5ubuntu51:10.2.1+ds-1ubuntu1
Show 5 moreShow less
1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu3.11:10.2.1+ds-1ubuntu3.21:10.2.1+ds-1ubuntu3.3
None known
qemu-hwe
Ubuntu:26.04:LTS
All versions, plus listed versions
1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu4.21:10.2.1+ds-1ubuntu4.31:10.2.1+ds-1ubuntu4.4
None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubM8seven/cve-2026-12080-qemu-guest-agent-authorized-keys2026-10-22

What each source reports

CVE List Score used7.3

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Record
CVE-2026-12080
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-09
EUVDEUVD-2026-459417.3

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Record
EUVD-2026-45941
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-09
GitHub AdvisoriesGHSA-9xqq-92hv-jj347.3

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a...

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Record
GHSA-9xqq-92hv-jj34
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-09
NVD7.3

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Record
CVE-2026-12080
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-61
Updated
2026-11-09
OSVBELL-CVE-2026-120807.3
Record
BELL-CVE-2026-12080
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-07
OSVDEBIAN-CVE-2026-120807.3

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Record
DEBIAN-CVE-2026-12080
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-07
Show 9 moreShow less
OSVOESA-2026-40847.3

qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.(CVE-2026-12080)

Record
OESA-2026-4084
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-40857.3

qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.(CVE-2026-12080)

Record
OESA-2026-4085
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-40867.3

qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.(CVE-2026-12080)

Record
OESA-2026-4086
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-40877.3

qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.(CVE-2026-12080)

Record
OESA-2026-4087
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:884217.3

Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update

Record
RHSA-2026:88421
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVRLSA-2026:884217.3

Important: qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

  • qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080)

Bug Fix(es) and Enhancement(s):

  • qemu-img can't create a qcow2 overlay with 'data_file' feature on top of a file without destroying the original image [rhel-9.8.z] (JIRA:Rocky Linux-164549)

  • live migration of a VM with a scsi3pr to a node that previously held a reservation on that disk fails. [rhel-9.8.z] (JIRA:Rocky Linux-280223)

  • Fix pending QEMU issues for L1VH GA - QEMU [rhel-9.8.z] (JIRA:Rocky Linux-283121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:88421
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-120807.3

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Record
UBUNTU-CVE-2026-12080
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:88421No score

Important: qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

  • qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080)

Bug Fix(es) and Enhancement(s):

  • qemu-img can't create a qcow2 overlay with 'data_file' feature on top of a file without destroying the original image [almalinux-9.8.z] (JIRA:AlmaLinux-164549)
  • live migration of a VM with a scsi3pr to a node that previously held a reservation on that disk fails. [almalinux-9.8.z] (JIRA:AlmaLinux-280223)
  • Fix pending QEMU issues for L1VH GA - QEMU [almalinux-9.8.z] (JIRA:AlmaLinux-283121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:88421
Updated
2026-11-04
OSVAZL-93006No score

CVE-2026-12080 affecting package qemu 10.1.0-2

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Record
AZL-93006
Updated
2026-11-05

History

History
RecordedChangedSources
affected, aliases, referencesGitHub Advisories, NVD, OSV
products, referencesCVE List
products, referencesEUVD, OSV
affected, aliases, published, referencesGitHub Advisories, NVD, OSV
referencesCVE List
products, referencesCVE List, EUVD, NVD, OSV
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 15 moreShow less
This page doesn't list everything

Left out here: 230 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open