The vulnerability in libvirt (CVE-2026-63622) involves a symlink-following flaw in the virFileChownFiles() function. A local attacker with swtpm user confinement can plant symbolic links within the swtpm state directory, causing the root-level libvirt daemon to change ownership of arbitrary files to the swtpm user. This results in privilege escalation from the swtpm sandbox to root-level file ownership control. The issue affects numerous Ubuntu package versions of libvirt. The Red Hat advisory recommends removing the <tpm> device from domain XML configurations to prevent libvirt from spawning swtpm processes and invoking the vulnerable code path if vTPM is not needed. For domains requiring vTPM, applying the upstream fix is advised.

Successful exploitation allows a local attacker confined to the swtpm user to escalate privileges by gaining root-level ownership control over arbitrary files. This can compromise confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score is 7.8 (high impact) with low attack complexity and no user interaction required.

If virtual Trusted Platform Module (vTPM) functionality is not required, remove the <tpm> device definition from the domain XML configuration to prevent the vulnerable code path from being reached. This blocks libvirt from spawning swtpm processes and calling the vulnerable function. For domains that require vTPM, this mitigation is not applicable, and applying the upstream fix should be prioritized. Patch status is not explicitly confirmed in the provided data; check vendor advisories for updates.