CVE-2026-13622

CVE-2026-13622 is a KubeVirt vulnerability that exploits a namespace boundary assumption baked into the live migration architecture. The root cause is virt-handler's use of /proc/<pid>/root/ paths to access sockets inside the target pod's filesystem view during migration. This mechanism is functionally necessary — live migration cannot work without crossing into the target pod's mount namespace — but it creates an implicit trust: that paths resolved through /proc/<pid>/root/ represent the socket endpoints they claim to be. When a container redirects those paths via symlink, they resolve against the host filesystem because virt-handler runs in the host mount namespace, not the container's. That is the exploit chain: legitimate migration mechanism + container-controlled path redirection + host-context resolution. The io.Copy proxy during migration is the blast radius multiplier. This isn't a read-limited or single-command interaction — it's a full bidirectional relay to the CRI-O API maintained for the duration of the migration. An attacker with namespace-edit plus pods/exec permissions can query, probe, and sequence commands: pull images, create containers, spawn execution processes. The CRI-O socket's documented capability surface becomes reachable from a container with those permissions. The permission prerequisite matters. Namespace-edit plus pods/exec was likely a legitimate administrative configuration in earlier KubeVirt deployments when the migration proxy operated within a different trust boundary. The surrounding security posture has hardened — tighter RBAC defaults, seccomp profiles, runtime isolation — while this code path continued running on the original assumptions. The vulnerability is a stranded trust assumption, not merely a design flaw. The attack window is constrained to active migration, which limits both exploitability and detectability. Migration generates expected network activity, making anomalous CRI-O commands harder to baseline. This timing constraint is often used to downplay urgency — 'it only works during migration' — but the channel persists for the migration duration and can establish multiple footholds in a single window. Audit your KubeVirt deployments for RBAC bindings that combine namespace-edit with pods/exec. Investigate whether your runtime isolation layers (seccomp, SELinux) restrict CRI-O socket access regardless of path resolution — that interaction determines whether this represents an actual exposure or a theoretical one. The fix requires redesigning how the migration proxy accesses sockets without /proc/<pid>/root/ traversal, which is not a trivial patch but an architectural change with operational deployment implications.

Reviewed through automated stages and approved by a human before publication.