PT-2025-45440 · Kubevirt+2 · Kubevirt+2

Published 2025-11-06 · Updated 2026-02-27 · CVE-2025-64437

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions KubeVirt versions prior to 1.5.3 KubeVirt versions prior to 1.6.1

Description KubeVirt, a virtual machine management add-on for Kubernetes, contains a flaw where the virt-handler does not validate if the launcher-sock is a symbolic link or a regular file. An attacker controlling the file system of a virt-launcher pod could exploit this to alter file ownership on the host node to an unprivileged user (UID 107), potentially compromising the confidentiality, integrity, and availability of host data.

Recommendations Update KubeVirt to version 1.5.3 or later. Update KubeVirt to version 1.6.1 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

AZL-69805

AZL-69970

CVE-2025-64437

GHSA-2R4R-5X78-MVQF

GO-2025-4102

OPENSUSE-SU-2025:15772-1

OPENSUSE-SU-2026:20281-1

SUSE-SU-2025:4330-1

SUSE-SU-2026:20551-1

SUSE-SU-2026:20610-1

Affected Products

Kubevirt

Kubernetes

Suse

References · 49

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64437.json · Exploit
• https://github.com/kubevirt/kubevirt/commit/3ce9f41c54d04a65f10b23a46771391c00659afb · Patch
• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-2r4r-5x78-mvqf · Vendor Advisory
• https://github.com/kubevirt/kubevirt/commit/8644dbe0d04784b0bfa8395b91ecbd6001f88f6b · Patch
• https://github.com/kubevirt/kubevirt/commit/f59ca63133f25de8fceb3e2a0e5cc0b7bdb6a265 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:4330-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64437 · Security Note
• https://osv.dev/vulnerability/GO-2025-4102 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2r4r-5x78-mvqf · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69970 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20281-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69805 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15772-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20551-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64437 · Vendor Advisory