CVE-2026-63622 is a local privilege escalation vulnerability in libvirt's virFileChownFiles() function caused by improper symlink resolution (CWE-59). A process running as the confined swtpm user can plant a symbolic link in the swtpm state directory, causing the root-level libvirt daemon to change ownership of arbitrary files to the swtpm user. This allows escalation from the swtpm sandbox to root-level file ownership control. The vulnerability affects multiple specific versions of libvirt distributed by Red Hat and Ubuntu. Mitigation involves removing the <tpm> device from domain XML to prevent libvirt from spawning swtpm processes and invoking the vulnerable code path. Domains requiring vTPM must apply the upstream fix. The vulnerability has a Red Hat CVSS v3.1 base score of 7.8 (high severity).

An attacker with local access running as the confined swtpm user can exploit this vulnerability to escalate privileges to root-level file ownership control by abusing a symlink-following flaw. This compromises confidentiality, integrity, and availability of the affected system by allowing unauthorized file ownership changes.

If virtual TPM (vTPM) functionality is not needed, remove the <tpm> device definition from the domain XML configuration to prevent the vulnerable code path from being executed. This stops libvirt from spawning swtpm processes and calling the vulnerable function. For domains that require vTPM, prioritize applying the upstream fix from Red Hat. Monitor Red Hat advisories for official patches and updates.