The vulnerability in Red Hat OpenShift Virtualization 4 arises from KubeVirt's safepath package's OpenAtNoFollow function, which uses O_PATH|O_NOFOLLOW flags to obtain a file descriptor without following symlinks. However, subsequent helper functions operate through /proc/self/fd/N and invoke system calls that follow symlinks, defeating the no-follow protection. This discrepancy allows an attacker with access to a virt-launcher pod to exploit the symlink dereference to cause virt-handler to modify file ownership or permissions on unintended host filesystem paths, potentially impacting system integrity and availability.

An attacker with access to a virt-launcher pod can exploit this vulnerability to cause virt-handler to apply file ownership or permission changes to unintended host paths. This can lead to unauthorized modification of host filesystem permissions or ownership, potentially disrupting system operations or enabling further privilege escalation. The CVSS score of 5.2 reflects a medium severity with limited attack vector (local), low complexity, and no user interaction required, but with a scope change and impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-13201 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Until a patch is available, restrict access to virt-launcher pods to trusted users only and monitor for suspicious activity related to file permission or ownership changes on the host. Follow Red Hat's official guidance once published.