SUSE Kubevirt Security Issues Addressed in Recent Updates

SUSE released an important security update for kubevirt-1.6 on August 17, 2026, addressing multiple vulnerabilities. Notably, CVE-2025-47911 allows denial of service due to inefficient HTML parsing, while CVE-2025-47914 can lead to a panic from out-of-bounds reads in SSH agent requests. Both vulnerabilities affect various kubevirt containers, including virt-api and virt-controller. The CVE-2025-47911 was published on February 5, 2026, and has a CVSS score of 4.0, indicating moderate severity. The update aims to mitigate potential exploits that could compromise system integrity and escalate privileges. Security experts recommend auditing Linux privileges to prevent system-wide damage. Meanwhile, a separate moderate security update for openSUSE Kubevirt Container Disk was released on August 16, 2026, but details on vulnerabilities fixed in that update were not specified. Users are encouraged to apply the updates promptly to safeguard their systems.

Key Points: • SUSE kubevirt-1.6 update fixes CVE-2025-47911 and CVE-2025-47914. • CVE-2025-47911 poses a denial of service risk due to HTML parsing issues. • Security experts recommend auditing Linux privileges to limit potential exploits.