PT-2025-45513 · Kubevirt+1 · Kubevirt+1

Published 2025-11-06 · Updated 2026-02-27 · CVE-2025-64435

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions KubeVirt versions prior to 1.7.0-beta.0

Description KubeVirt, a virtual machine management add-on for Kubernetes, contains a flaw in the virt-controller. An attacker can disrupt control over a running Virtual Machine Instance (VMI) by creating a pod with labels matching those of the legitimate virt-launcher pod associated with the VMI. This can cause the virt-controller to incorrectly associate the malicious pod with the VMI, leading to incorrect status updates and a potential Denial-of-Service (DoS) condition. The issue stems from a logic error in how the virt-controller manages pod associations with VMIs.

Recommendations Upgrade to KubeVirt version 1.7.0-beta.0 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-703

Related Identifiers

AZL-69802

AZL-69964

CVE-2025-64435

GHSA-9M94-W2VQ-HCF9

GO-2025-4105

OPENSUSE-SU-2026:20281-1

SUSE-SU-2026:0479-1

SUSE-SU-2026:20551-1

SUSE-SU-2026:20610-1

Affected Products

Kubevirt

Kubernetes

References · 40

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64435.json · Exploit
• https://github.com/kubevirt/kubevirt/commit/9a6f4a3a707992038ef705da4cb3bba8c89d36ba · Patch
• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-9m94-w2vq-hcf9 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20551-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64435 · Security Note
• https://osv.dev/vulnerability/GHSA-9m94-w2vq-hcf9 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20281-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0479-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69964 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4105 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20610-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69802 · Vendor Advisory
• https://github.com/kubevirt/kubevirt · Note
• https://bugzilla.suse.com/1253186 · Note