CVE-2026-13201 is a vulnerability in KubeVirt's safepath package where the OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to get a file descriptor to a path leaf, but subsequent operations dereference symlinks via /proc/self/fd/N, defeating no-follow protections. This enables an attacker with access to a virt-launcher pod to replace the notify socket path with a symlink to an attacker-controlled socket, injecting arbitrary VM domain lifecycle events into virt-handler. As virt-handler trusts this IPC channel, injected events can cause incorrect VM lifecycle actions, corrupt Kubernetes API VM state, or crash virt-handler, resulting in denial of VM management services on the node. A secondary impact is that virt-handler can apply chown/chmod changes to unintended host files, though SELinux enforcing mode and RHCOS immutability limit this risk. No current mitigation prevents the notify socket hijacking vector. The vulnerability has a Red Hat CVSS v3 score of 7.3 (High).

An attacker with namespace-level access to a virt-launcher pod can hijack virt-handler's IPC notify socket, injecting arbitrary VM lifecycle events without validation. This can cause incorrect VM shutdowns, restarts, migrations, corrupt VM resource state in Kubernetes, or crash virt-handler, leading to sustained denial of VM management services on the affected node. Secondary impact includes unauthorized file ownership or permission changes on the host filesystem, though this is limited by SELinux and immutable filesystem protections. There is no confidentiality impact reported.

No fix is currently available for the notify socket hijacking vector. Mitigations include restricting RBAC permissions to limit pod/exec access to virt-launcher pods to only necessary users, reducing the attacker pool. Ensure SELinux is in enforcing mode to restrict file modification impact and rely on RHCOS immutable filesystem layers to protect core OS files. Note that these mitigations do not prevent the primary notify socket hijacking attack vector.