9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24834

CVE-2026-24834: Kata Container to Guest micro VM privilege escalation

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container to modify the file system used by the Guest micro VM ultimately achieving arbitrary code execution as root in said VM. The current understanding is this doesn’t impact the security of the Host or of other containers / VMs running on that Host (note that arm64 QEMU lacks NVDIMM read-only support: It is believed that until the upstream QEMU gains this capability, a guest write could reach the image file). Version 3.27.0 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24834

CVE-2026-24834:

9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/kata-containers/kata-containers/src/runtime	go	< 0.0.0-20260219090056-6a672503973b	0.0.0-20260219090056-6a672503973b

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a container to gain root access within its guest micro-VM by modifying the underlying guest root filesystem image. This is caused by the Kata Containers runtime incorrectly configuring the guest image as a writable virtio-pmem (NVDIMM) device when using the Cloud Hypervisor hypervisor.

The analysis of the patch (commit 6a672503973bf7c687053e459bfff8a9652e16bf) reveals the root cause in both the Go and Rust-based runtimes. In both implementations, logic existed to use virtio-pmem for the root filesystem. This device type, when combined with DAX (Direct Access), maps the host's image file directly into the guest's memory. The vulnerability stems from the fact that this mapping was not being configured as read-only.

Key vulnerable functions identified are:

virtcontainers.cloudHypervisor.CreateVM (Go): This function contained the logic that would choose to create a PmemConfig instead of a DiskConfig, leading to the writable device.
virtcontainers.qemuArm64.appendNvdimmImage (Go): This ARM64-specific function created an NVDIMM device without the ReadOnly flag, as the underlying QEMU version lacked support for it.
ch_config::convert::VmConfig::try_from (Rust): This function converted configuration into a PmemConfig, which was the source of the vulnerability in the Rust runtime.
hypervisor::ch::inner_hypervisor::CloudHypervisorInner::create_vm_config (Rust): This function selected virtio-pmem as the driver, triggering the vulnerable condition.

The patch remediates the issue by removing the code paths that use virtio-pmem for the root image with Cloud Hypervisor, and instead consistently uses virtio-blk-pci with a read-only disk configuration. It also disables DAX on ARM64 to prevent a related kernel panic.

Vulnerable functions

virtcontainers.cloudHypervisor.CreateVM

src/runtime/virtcontainers/clh.go

The `CreateVM` function in the Go runtime for CloudHypervisor would incorrectly configure the root filesystem image. When not explicitly disabled, it used a `PmemConfig` (`virtio-pmem`) which did not enforce a read-only mapping of the guest image, allowing a container to write to the guest's root filesystem. The patch removes this logic, forcing the use of `DiskConfig` (`virtio-blk`) which is correctly configured as read-only.

virtcontainers.qemuArm64.appendNvdimmImage

src/runtime/virtcontainers/qemu_arm64.go

This function, specific to the ARM64 architecture with QEMU, was responsible for attaching the guest image as an NVDIMM device. The implementation created the device without setting the `ReadOnly` flag, because the QEMU version used for ARM64 did not support it. This resulted in the guest's root filesystem being writable. The patch completely removes this vulnerable function, falling back to a `virtio-blk` device.

ch_config::convert::VmConfig::try_from

src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs

In the Rust runtime (`runtime-rs`), this `try_from` implementation was responsible for converting a hypervisor configuration into a VM configuration for Cloud Hypervisor. The vulnerable path involved creating a `PmemConfig` from the boot information, which led to the guest image being mapped as writable. The patch removes the creation of `PmemConfig`, replacing it with `DiskConfig` to ensure the image is treated as a read-only block device.

hypervisor::ch::inner_hypervisor::CloudHypervisorInner::create_vm_config

src/runtime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs

This function in the Rust runtime was responsible for creating the VM configuration. It contained logic that would select `VM_ROOTFS_DRIVER_PMEM` (`virtio-pmem`) as the root filesystem driver for non-confidential guests. This choice of driver is what led to the vulnerability. The patch removes this conditional logic and hardcodes the driver to `VM_ROOTFS_DRIVER_BLK` (`virtio-blk-pci`), which is not vulnerable.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.