Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-63622

CVE-2026-63622HIGH

Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support — Libvirt: swtpm privilege escalation via symlink following

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0014    2.9     —

AFFECTED
  Product                                                                Versions     Fixed
  Red Hat Enterprise Linux 10.0 Extended Update Support                  unspecified  0:10.10.0-8.11.el10_0
  Red Hat Enterprise Linux 7 Extended Lifecycle Support                  unspecified  0:4.5.0-36.el7_9.7
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support  unspecified  8040020260916092751.522a0ee4
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On  unspecified  8040020260916092751.522a0ee4
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support  unspecified  8060020260910092451.ad008a3a
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On  unspecified  8060020260910092451.ad008a3a
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service         unspecified  8080020260910092120.63b34585
  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions         unspecified  8080020260910092120.63b34585
  Red Hat Enterprise Linux 9                                             unspecified  0:11.10.0-12.7.el9_8
  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions         unspecified  0:9.0.0-10.16.el9_2
  + 6 more

TIMELINE
  Jul 17  Reserved by redhat
  Aug 10  Published (CNA: redhat)
  Sep 7   PATCH SHIPPED — CVE-2026-63622 (Red Hat Enterprise Linux 10.0 Extended Update Support). Fixed in Red Hat Enterprise Linux 10.0 Extended Update Support 0:10.10.0-8.11.el10_0.

CWE-59 · CNA: redhat · CVSS v3.1 · 11 references · NVD status: Awaiting Analysis

Description

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 17, 2026	Reserved	Reserved by redhat
August 10, 2026	Published	Published (CNA: redhat)
September 7, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-63622 (Red Hat Enterprise Linux 10.0 Extended Update Support). Fixed in Red Hat Enterprise Linux 10.0 Extended Update Support 0:10.10.0-8.11.el10_0.

Affected

Affected products and packages — 16 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	—	—	0:10.10.0-8.11.el10_0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	—	—	0:4.5.0-36.el7_9.7
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	—	—	8040020260916092751.522a0ee4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	—	—	8040020260916092751.522a0ee4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	—	—	8060020260910092451.ad008a3a
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	—	—	8060020260910092451.ad008a3a
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	—	—	8080020260910092120.63b34585
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	—	—	8080020260910092120.63b34585
Red Hat	Red Hat Enterprise Linux 9	—	—	0:11.10.0-12.7.el9_8
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	—	—	0:9.0.0-10.16.el9_2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	—	—	0:10.0.0-6.23.el9_4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	—	—	0:10.10.0-7.18.el9_6
Red Hat	Red Hat Enterprise Linux 10	—	—	—
Red Hat	Red Hat Enterprise Linux 6	—	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—	—
Red Hat	Red Hat Enterprise Linux for NVIDIA 26	—	—	—

Weaknesses

CWE-59

References (11)

Authoritative record: CVE-2026-63622 at cve.org

Vendors: red hat

Weaknesses: CWE-59

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-63622 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.