Back Linuxsecurity

SUSE kubevirt Important Security Issues Resolved 2026-3630

Linuxsecurity •LinuxSecurity Advisories • August 18, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

## This update for kubevirt-1.6, virt-api-container-1.6, virt-controller- container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools- container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt- synchronization-controller-container-1.6 fixes the following issues: Security issues fixed: * CVE-2025-47911: golang.org/x/net/html: algorithms that have quadratic complexity when parsing HTML documents allow for denial of service (bsc#1251420). * CVE-2025-47914: golang.org/x/crypto/ssh/agent: no validation of message size when processing new identity requests can cause a panic due to an out-of- bounds read (bsc#1254014).

* CVE-2025-47911 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

* CVE-2025-47911 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2025-47911 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Announcement ID: SUSE-SU-2026:3630-1 Release Date: 2026-08-17T16:50:38Z Rating: important

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE Kubevirt Security Issues Addressed in Recent Updates SUSE released an important security update for kubevirt-1.6 on August 17, 2026, addressing multiple vulnerabilities. Notably, CVE-2025-47911 allows denial of service due to inefficient HTML parsing, while CVE-2025-47914 can lead to a panic from out-of-bounds reads in SSH agent requests. Both vulnerabilities affect various kubevirt containers, including virt-api and virt-controller. The CVE-2025-47911 was published on February 5, 2026, and has a CVSS score of 4.0, indicating moderate severity. The update aims to mitigate potential exploits that could compromise system integrity and escalate privileges. Security experts recommend auditing Linux privileges to prevent system-wide damage. Meanwhile, a separate moderate security update for openSUSE Kubevirt Container Disk was released on August 16, 2026, but details on vulnerabilities fixed in that update were not specified. Users are encouraged to apply the updates promptly to safeguard their systems. 2 sources 58

Extracted Entities

SUSE kubevirt Important Security Issues Resolved 2026-3630

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)

Domains (1)

Platforms (1)