CVE-2025-2515 describes an incorrect authorization vulnerability in BlueChi, a multi-node systemd service controller used in RHIVOS. A user with root privileges on a managed node (qm) can exploit this flaw to create or override systemd service unit files that impact the host node. This improper authorization can result in privilege escalation and unauthorized execution of services on the host, potentially compromising the system. The vulnerability has a CVSS 3.1 score of 7.2 (AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating it requires local privileged access but can cause significant impact on confidentiality, integrity, and availability. The vendor advisory from Red Hat does not explicitly mention a patch or remediation status.

An attacker with root privileges on a managed node can escalate privileges on the host node by creating or overriding systemd service unit files. This can lead to unauthorized service execution and full system compromise, affecting confidentiality, integrity, and availability of the host system.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-2515 for current remediation guidance. Until an official fix is available, restrict root access on managed nodes and monitor for unauthorized changes to systemd service unit files on host nodes.