QEMU guest agent SSH key flaw lets users seize root files

QEMU developers are closing a local root escalation in the guest agent: when the host or operator adds an SSH authorized key for a guest user, a crafted symlink could make the root-running agent transfer ownership of an arbitrary root-owned file or directory to that user (CVE-2026-12080).

The guest agent’s SSH helpers create or update a user’s .ssh material and then adjust ownership. Because those checks and writes followed symlinks, a user who controls their home directory could pre-stage .ssh or authorized_keys as a link. Once an operator triggered a key add for that account, the agent followed the link and chowned the target, after which the user could rewrite it and obtain root.

Valentino Paulon reported the issue. Kostiantyn Kostiuk of Red Hat posted an initial fix that stops following symlinks when creating directories and setting ownership on the authorized-keys path. On the QEMU development list, Daniel P. Berrangé and Paulon argued for a stronger model: for these commands only, drop effective uid and gid to the target user before any I/O so every step is limited to what that user could already do, removing the whole TOCTOU class rather than one instance of it.

Paulon noted practical details such as clearing supplementary groups and keeping the change reversible. Kostiuk raised that the agent is not strictly required to run as root; Berrangé replied that in practice it is a system daemon exposing privileged commands, and unprivileged deployment should be treated as broken, possibly by refusing to start.