The vulnerability arises from the use of textproto.Reader.ReadLine() in KubeVirt's downward metrics virtio-serial server, which buffers input indefinitely until a newline character is received, without any length limit or read deadline. A user with access to a VM guest configured with the downward metrics virtio-serial device can exploit this by writing a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process. This results in the process being OOM-killed, impacting availability but not confidentiality or integrity.

The impact is limited to availability, as the unbounded memory allocation can cause the virt-handler process to be terminated due to out-of-memory conditions. There is no impact on confidentiality or integrity. The CVSS base score is 3.8 (low severity), reflecting the limited scope of the impact and the requirement for local privileges (access to a VM guest).

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-13322 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Users should monitor the vendor advisory for updates and apply any patches or mitigations once available.