A local privilege escalation vulnerability exists in the qemu-guest-agent component of qemu-kvm due to a symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080). This issue allows a local attacker within the guest to escalate privileges. The vulnerability affects versions of qemu-guest-agent prior to 17:10.1.0-17.el9_8.9.alma.1. A patch is available in this fixed version. Additional bug fixes and enhancements are included in the update.